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System  (Report  No.  D-2002-056) 


We  are  providing  this  report  for  review  and  comment.  This  is  the  second 
report  in  a  series  related  to  controls  over  the  Computerized  Accounts  Payable 
System.  We  considered  management  comments  on  a  draft  of  this  report  when 
preparing  the  final  report. 

DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved 
promptly.  The  Under  Secretary  of  Defense  (Comptroller)  comments  were  partially 
responsive.  The  Acting  Chief  Financial  Officer  did  not  address  the  development  of 
standard  business  rules  or  provide  a  completion  date  for  taking  corrective  actions  in 
response  to  Recommendation  A.l.  Comments  from  the  Director,  Commercial  Pay 
Services,  for  the  Defense  Finance  and  Accounting  Service  were  generally 
responsive.  However,  we  request  additional  comments  on  Recommendations 
A.2.b.,  A.2.C.,  B.2.,  B.3.,  C.l.c.,  and  C.2.b.  The  Deputy  Assistant  Secretary  of 
the  Army  (Financial  Operations)  comments  were  responsive.  The  Assistant 
Secretary  of  the  Army  (Acquisition,  Technology,  and  Logistics)  did  not  provide 
comments  on  the  draft  report.  Therefore,  we  request  that  the  Assistant  Secretary  of 
the  Army  (Acquisition,  Technology,  and  Logistics)  provide  comments  on 
Recommendations  C.l.  and  C.3.  We  request  that  management  provide  all  comments 
by  May  6, 2002. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Mr.  Marvin  L.  Peek  at  (703)  604-9587 
(DSN  664-9587)  (mpeek@dodig.osd.mil)  or  Mr.  Carmelo  G.  Ventimiglia  at 
(317)  510-3852  (DSN  699-3852)  (cventimiglia@dodig.osd.mil).  See  Appendix  G 
for  the  report  distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


Thomas  F.  Gimble 
Acting 

Deputy  Assistant  Inspector  General 
for  Auditing 
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Controls  Over  Vendor  Payments  Made  for  the  Army  and 
Defense  Agencies  Using  the  Computerized 
Accounts  Payable  System 

Executive  Summary 

Introduction.  Serious  internal  control  weaknesses  have  been  reported  over  the  years  in 
DoD  payment  processes  and  systems.  As  a  result  of  those  weaknesses,  the  risk  of 
fraud  and  error  is  increased.  Errors  can  include  duplicate  payments,  payments  in  the 
wrong  amount,  or  charges  to  the  wrong  account. 

The  Defense  Finance  and  Accounting  Service  (DFAS)  uses  two  versions  of  the 
Computerized  Accounts  Payable  System  (CAPS)  to  make  vendor  payments  for  the 
Army  and  several  Defense  agencies.  During  FY  2000,  DFAS  made  about 
902,000  vendor  payments,  valued  at  $13.7  billion,  using  CAPS.  On  April  1,  2001,  the 
Director,  DFAS,  capitalized  all  commercial  payment  resources  under  the  Director, 
Commercial  Pay  Services.  This  is  the  second  in  a  series  of  audit  reports  addressing  the 
controls  over  CAPS. 

Objectives.  Our  objectives  were  to  evaluate  the  controls  associated  with  making 
payments  using  CAPS  and  progress  in  transitioning  to  the  Defense  Procurement 
Payment  System.  This  report  focuses  on  the  controls  associated  with  making  vendor 
payments.  We  also  evaluated  the  effectiveness  of  the  management  control  program  as 
it  related  to  making  vendor  payments  using  CAPS. 

Results.  DFAS  field  sites  did  not  implement  effective  and  consistent  internal  controls 
to  detect  and  correct  improperly  supported  or  erroneous  payments.  As  a  result,  DFAS 
made  at  least  $13.2  million  in  duplicate  payments,  an  estimated  30,584  payments  in  the 
wrong  amounts,  and  other  vendor  payments  that  did  not  comply  with  5  Code  of  Federal 
Regulations  Part  1315  (finding  A). 

Access  to  the  two  versions  of  CAPS  was  not  adequately  controlled  and  monitored. 
System  access  controls  did  not  properly  segregate  duties,  access  to  payment  functions 
was  not  consistently  assigned  to  payment  technicians  at  DFAS  field  sites,  and  remote 
users  were  given  inappropriate  access  to  CAPS  for  Windows.  As  a  result,  the  system 
was  susceptible  to  improper  and  unauthorized  use  and  individual  users  could 
circumvent  the  requirements  of  5  Code  of  Federal  Regulations  Part  1315  (finding  B). 

DFAS  field  sites  frequently  made  erroneous  payments  and  other  payments  that  were  not 
fully  supported  by  proper  documents.  We  estimate  that  181,406  of  the  236,940  vendor 
payments  made  by  DFAS  field  sites  for  the  Army  and  Defense  agencies  from  May  1 
through  July  31,  2000,  lacked  at  least  one  element  of  support  required  by  5  Code  of 
Federal  Regulations  Part  1315.  We  also  estimate  that  30,584  payments  were  in  the 
wrong  amounts.  As  a  result,  DoD  managers  assumed  an  increased  risk  that  payments 
were  not  being  made  in  compliance  with  the  Prompt  Payment  Act.  In  addition, 
resources  were  diverted  from  their  intended  use  due  to  efforts  to  correct  duplicate 


payments  and  other  erroneous  payments  (finding  C).  These  deficiencies  constitute  a 
material  control  weakness.  See  Appendix  A  for  details  on  the  management  control 
program  as  it  relates  to  controls  over  vendor  payments. 

Summary  of  Recommendations.  We  recommend  that  the  Under  Secretary  of  Defense 
(Comptroller),  in  coordination  with  DFAS,  develop  and  incorporate  into  DoD 
Regulation  7000. 14-R,  volume  10,  standard  business  rules  for  making  vendor  payments 
that  incorporate  the  requirements  of  5  Code  of  Federal  Regulations  Part  1315,  the  Debt 
Collection  Improvement  Act  of  1996,  and  recent  changes  to  the  Federal  Acquisition 
Regulation.  We  recommend  that  DFAS  develop  effective  programs  for  identifying  and 
correcting  problems  in  making  vendor  payments.  We  also  recommend  that  DFAS 
establish  standard  system  access  profiles,  make  needed  system  changes,  and  develop 
plans  to  use  other  than  the  disk  operating  system  version  of  CAPS  if  system  access 
controls  can  not  be  improved  and  to  overcome  obstacles  that  prevent  the  automated 
interfacing  of  data  into  CAPS  for  Windows. 

We  recommend  that  the  Army,  in  coordination  with  DFAS,  train  personnel  at 
designated  billing  offices  and  Army  receiving  activities  on  the  standards  for  properly 
date-stamping  documents  and  receiving  and  accepting  goods  and  services.  We 
recommend  that  DFAS  improve  the  accuracy  of  payments  by  directing  field  sites  to 
follow  the  requirements  for  computing  payment  due  dates.  We  also  recommend  that 
the  Army  direct  contracting  offices  to  improve  the  use  of  delivery  orders  and 
comprehensiveness  of  contracting  documents. 

Management  Comments.  The  Acting  Deputy  Chief  Financial  Officer  stated  that  DoD 
Regulation  7000. 14-R  was  being  changed  to  incorporate  5  Code  of  Federal  Regulations 
Part  1315  and  the  Debt  Collection  Improvement  Act  of  1996.  However,  the 
development  of  standard  business  rules  for  making  vendor  payments  and  a  completion 
date  for  issuance  of  the  revised  guidance  was  not  addressed.  In  commenting  for  DFAS, 
the  Director,  Commercial  Pay  Services,  partially  agreed  with  most  recommendations, 
but  did  not  did  not  agree  to  perform  frequent  post-payment  reviews;  remove  remote 
system  access  to  update  information  in  CAPS  for  Windows;  discontinue  using  Standard 
Form  1034  as  an  invoice,  receiving  report,  and  obligation  document;  and  establish 
reasonableness  standards  for  receipt  and  acceptance  dates  on  receiving  reports.  The 
Deputy  Assistant  Secretary  of  the  Army  (Financial  Operations)  agreed  to  issue  detailed 
guidance  on  processing  receiving  reports.  The  Assistant  Secretary  of  the  Army 
(Acquisition,  Technology,  and  Logistics)  did  not  provide  comments  on  the  draft  report. 
See  the  Finding  section  of  the  report  for  a  discussion  of  management  comments  and  the 
Management  Comments  section  for  a  complete  text  of  the  comments. 

Audit  Response.  The  Under  Secretary  of  Defense  (Comptroller)  comments  were 
partially  responsive.  However,  further  comments  are  needed  to  address  the  need  to 
develop  and  incorporate  standard  business  rules  for  making  all  types  of  vendor 
payments  in  DoD  Regulation  7000. 14-R,  volume  10.  DFAS  comments  were  generally 
responsive.  However,  additional  actions  need  to  be  taken  to  improve  the  internal 
control  environment  when  making  vendor  payments  using  CAPS.  We  request  that 
DFAS  reconsider  its  position  regarding  the  frequency  of  post-payment  voucher  reviews, 
removing  remote  system  access  to  update  information  in  CAPS  for  Windows,  limiting 
the  use  of  Standard  Form  1034,  and  working  with  the  Army  to  establish  reasonableness 
standards  for  receipt  and  acceptance  dates  on  receiving  reports.  We  request  that  the 
Under  Secretary  of  Defense  (Comptroller),  the  Assistant  Secretary  of  the  Army 
(Acquisition,  Technology,  and  Logistics),  and  DFAS  provide  comments  on  the  final 
report  by  May  6,  2002. 
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Background 


Vendor  Payments.  As  a  general  rule,  payments  must  be  supported  by  an 
obligating  document  (contract,  purchase  order,  or  other  document  obligating 
DoD  to  pay  for  goods  or  services),  an  invoice,  and  a  receiving  report.  The 
current  vendor  payment  process  depends  on  the  receipt  and  processing  of 
hard-copy  documents.  Technicians  review  supporting  documents  for  accuracy 
and  completeness  before  entering  them  into  the  Computerized  Accounts  Payable 
System  (CAPS).  Certifying  officers  should  compare  the  payment  vouchers  to 
the  supporting  invoices,  receiving  reports,  and  contract  or  obligation  documents 
to  ensure  the  accuracy  of  the  payment  information  before  approving  the 
vouchers  for  payment.  Following  certification,  a  payment  voucher  is  created 
and  the  payment  information  is  loaded  into  the  disbursing  system.  The 
disbursing  system  uses  the  payment  transactions  generated  by  CAPS  to  make 
disbursements. 

Automated  Systems  for  Making  Vendor  Payments.  The  Defense  Finance  and 
Accounting  Service  (DFAS)  uses  15  different  systems  to  make  vendor 
payments.  Two  versions  of  CAPS  are  used  to  make  vendor  payments  for  the 
Army  and  Defense  agencies.  Eight  DFAS  field  sites  used  CAPS  for  Windows 
(CAPS[W])  to  make  vendor  payments.  The  disk  operating  system  version  of 
CAPS  (CAPS  Clipper)  was  used  by  DFAS  Europe,  Kaiserslatem,  Germany; 
DFAS  Rock  Island,  Rock  Island,  Illinois;  DFAS  St.  Louis,  St.  Louis,  Missouri; 
the  54  United  States  Property  and  Fiscal  Offices  (USPFOs);  and  several  other 
DoD  organizations.  The  two  versions  of  CAPS  receive  data  primarily  from 
manual  sources.  CAPS  uses  both  automated  and  manual  controls  to  maintain 
accurate  and  complete  data.  DFAS  initially  planned  to  replace  CAPS  with  the 
Defense  Procurement  Payment  System  (DPPS)  in  2001.  As  of  December  2001, 
the  plan  was  to  begin  transitioning  from  CAPS  to  DPPS  in  October  2003. 

Realignment  of  Vendor  Payment  Operations.  On  March  29,  2001,  the 
Director,  DFAS,  announced  the  capitalization  of  all  commercial  payment 
resources  under  the  commercial  pay  business  line.  Effective  April  1,  2001,  the 
Director,  Commercial  Pay  Services,  became  responsible  for  the  commercial  pay 
business  line.  This  business  line  is  comprised  of  two  product  lines  (contract  pay 
and  vendor  pay).  The  vendor  pay  product  line  encompasses  entitlement 
determination  for  contracts  not  administered  by  the  Defense  Contract 
Management  Agency,  transportation  payments,  and  miscellaneous  payments  to 
businesses  and  individuals.  Before  April  1,  2001,  DFAS  Indianapolis  was 
primarily  responsible  for  overseeing  operations  at  organizations  that  made 
vendor  payments  for  Army  customers  using  CAPS. 

Related  Audit  Reports.  In  General  Accounting  Office  (GAO)  Report 
No.  GAO/AIMD-98-274,  “Improvements  Needed  in  Air  Force  Vendor  Payment 
Systems  and  Controls,”  September  28,  1998,  GAO  recommended  that  the 
Director,  DFAS,  strengthen  payment  processing  controls  by  establishing 
separate  organizational  responsibilities  for  entering  payment  data  and  revising 
vendor  payment  access  levels  to  correspond  with  the  new  structure.  In 
Inspector  General,  DoD,  Report  No.  D-2000-139,  “Controls  Over  the 
Integrated  Accounts  Payable  System,”  June  5,  2000,  we  recommended 
additional  improvements  in  the  processing  of  vendor  payments  using  the 
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Integrated  Accounts  Payable  System.  We  also  reported  that  significant  actions 
had  been  taken  to  establish  separate  organizational  responsibilities  for  entering 
payment  data  and  revising  vendor  payment  access  levels  to  correspond  with  the 
new  structure.  In  Inspector  General,  DoD,  Report  No.  D-2002-008,  “Controls 
Over  the  Computerized  Accounts  Payable  System  at  Defense  Finance  and 
Accounting  Service  Kansas  City,”  October  19,  2001,  we  concluded  that  the 
structure  and  business  practices  of  the  vendor  payment  office  at  DFAS  Kansas 
City  did  not  provide  efficient  and  effective  controls  over  vendor  payments.  In 
addition,  access  over  CAPS(W)  needed  improvement  and  vendor  payments  were 
often  not  properly  supported. 

Basic  Guidance.  The  principal  guidance  used  for  making  payment  to  vendors 
is  the  Prompt  Payment  Act  (PPA),  as  implemented  by  the  Office  of 
Management  and  Budget  (OMB)  in  5  Code  of  Federal  Regulations  (C.F.R.) 

Part  1315,  “Prompt  Payment;  Final  Rule,”  September  29,  1999.  5  C.F.R. 

Part  1315  identifies  documentation  requirements  for  supporting  vendor 
payments  and  rules  for  computing  payment  due  dates.  The  PPA  and  supporting 
documentation  requirements  are  further  described  in  the  Federal  Acquisition 
Regulation  (FAR)  subpart  32.9,  “Prompt  Payment;”  Defense  Federal 
Acquisition  Regulation  Supplement  (DFARS)  subpart  232.9,  “Prompt 
Payment;”  and  DoD  Regulation  7000. 14-R,  volume  10,  “Contract  Payment 
Policy  and  Procedures,”  November  1999.  Although  5  C.F.R.  Part  1315 
amended  the  requirements  of  the  PPA  when  it  was  issued  on  September  29, 
1999,  FAR  subpart  32.9  was  not  updated  until  December  18,  2001.  DoD 
Regulation  7000. 14-R,  volume  10,  has  not  yet  been  updated  to  comply  with 
5  C.F.R.  Part  1315  requirements. 

DoD  Regulation  7000. 14-R,  volume  5,  “Disbursing  Policy  and  Procedures,” 
chapter  33,  “Accountable  Officials  and  Certifying  Officers,”  August  1999, 
provides  guidance  for  appointing  certifying  officers,  outlines  the  responsibilities 
of  certifying  officers,  and  requires  post-payment  reviews  of  certified  payments. 
The  Debt  Collection  Improvement  Act  of  1996  requires  payments  by  Electronic 
Funds  Transfer  (EFT).  31  C.F.R.  Part  208,  “Management  of  Federal  Agency 
Disbursements;  Final  Rule,”  Section  208.4,  “Waivers,”  September  25,  1998, 
allows  specific  waivers  to  the  EFT  requirements. 

Objectives 


Our  objectives  were  to  evaluate  the  controls  associated  with  making  payments 
using  the  CAPS  and  progress  in  transitioning  to  DPPS.  This  report  focuses  on 
the  controls  associated  with  making  vendor  payments.  We  also  evaluated  the 
effectiveness  of  the  management  control  program  as  it  related  to  making  vendor 
payments  using  CAPS.  See  Appendix  A  for  a  discussion  of  the  audit  scope  and 
methodology  and  our  review  of  the  management  control  program.  See 
Appendix  B  for  a  summary  of  prior  coverage. 


2 


A.  Standardizing  the  Processing  of 
Vendor  Payments 

DFAS  field  sites  did  not  implement  effective  and  consistent  internal 
controls  to  make  properly  supported  vendor  payments  and  detect  and 
correct  improperly  supported  or  erroneous  payments.  Problems 
continued  to  exist  because: 

•  DFAS  did  not  develop  a  standard  vendor  payment  office 
structure  at  field  sites  using  CAPS, 

•  standard  business  rules  were  not  developed  to  control  and 
review  supporting  documents  and  payment  processing,  and 

•  efforts  to  improve  the  vendor  payment  process  were  not 
consistently  effective. 

As  a  result,  DFAS  made  at  least  $13.2  million  in  duplicate  payments,  an 
estimated  30,584  payments  in  the  wrong  amounts,  and  other  vendor 
payments  that  did  not  comply  with  5  C.F.R.  Part  1315. 

Internal  Control  Environment 

GAO  Report  No.  GAO/ AIMD-00-2 1.3.1,  “Standards  for  Internal  Control  in  the 
Federal  Government,”  November  1,  1999,  defines  internal  control  as  an  integral 
component  of  an  organization’s  management.  Public  law  and  regulations  are 
key  considerations  in  developing  business  rules  for  making  vendor  payments. 
Business  rules  should  ensure  a  strong  internal  control  environment  and 
adherence  to  public  laws  governing  the  processing  of  vendor  payments. 

Developing  a  Standard  Vendor  Payment  Structure 

DFAS  did  not  establish  a  standard  office  structure  at  field  sites  making  vendor 
payments  using  CAPS.  The  nine  DFAS  field  sites  we  visited  between 
August  2000  and  March  2001  had  different  office  structures  and  vendor 
payment  processes.  The  lack  of  a  standard  structure  and  consistent  business 
rules  for  making  vendor  payments  contributed  to  a  weak  internal  control 
environment  in  which  improperly  supported  and  erroneous  payments  were 
made.  The  use  of  a  standard  vendor  payment  structure  will  also  assist  with 
transitioning  DFAS  field  sites  to  an  operating  environment  that  uses  DPPS.  A 
detailed  discussion  of  a  standard  office  structure  for  making  vendor  payments  is 
in  Appendix  C.  Efficient  and  accurate  processing  of  vendor  payments  requires 
a  standard  office  structure  that  incorporates  strong  business  rules.  Vendor 
payment  duties  should  be  segregated  to  provide  adequate  checks  and  balances  in 
the  payment  process  while  maintaining  positive  control  over  supporting 
documents.  A  standard  structure  also  permits  the  development  of  system  access 
profiles  that  match  the  duties  assigned  to  each  individual  (finding  B).  In 
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response  to  Inspector  General,  DoD,  Report  No.  D-2002-008,  the  Director, 
Commercial  Pay  Services,  stated  that  the  commercial  pay  business  line  would 
develop  a  standard  organization  structure  for  use  at  all  vendor  pay  sites. 
Consequently,  we  did  not  make  that  recommendation  in  this  report. 

Developing  Standard  Business  Rules 


DFAS  did  not  develop  standard  business  rules  to  achieve  effective  control  over 
the  documents  supporting  vendor  payments  and  consistency  in  making  vendor 
payments.  Standard  business  rules  should  implement  the  requirements  in  the 
Debt  Collection  Improvement  Act  of  1996,  5  C.F.R.  Part  1315,  and  the  FAR. 
Once  developed,  the  business  rules  should  be  incorporated  in  DoD  Regulation 
7000. 14-R,  volume  10.  Standard  business  rules  should  complement  a  standard 
office  structure  and  define  a  business  environment  for  screening,  tracking, 
controlling,  entering,  prevalidating,  certifying,  and  researching  problems  with 
vendor  payments. 

Mailroom  Operations.  DFAS  did  not  establish  and  enforce  standard  business 
rules  for  receiving  and  date-stamping  all  vendor  payment  documents. 

Mailrooms  need  to  control  the  receipt  of  documents  supporting  vendor  payments 
and  date-stamp  documents  with  the  actual  dates  of  receipt. 

Proper  Receipt  of  Vendor  Payment  Documents.  Mailrooms  at  the 
nine  field  sites  were  not  always  secure  and  did  not  receive  all  incoming  vendor 
payment  documents.  For  example, 

•  The  mailroom  at  DFAS  Norfolk,  Norfolk,  Virginia,  was  in  an 
unsecured  location.  Anyone  could  add,  alter,  or  remove  documents 
without  being  detected.  During  our  visit,  DFAS  Norfolk  took 
actions  to  secure  the  mailroom. 

•  DFAS  San  Antonio,  San  Antonio,  Texas,  had  circumvented  the 
controls  of  the  RightFAX  server  by  allowing  facsimile  messages  to 
be  received  outside  of  the  RightFAX  server.  If  used  correctly,  the 
RightFAX  server  allowed  the  receipt  of  incoming  faxes  outside  the 
mailroom  because  the  server  established  control  over  incoming 
documents  by  recording  and  tracking  when  a  message  was  actually 
received.  A  DFAS  Internal  Review  team  reported  on  April  26, 

2001,  that  documents  circumventing  the  RightFAX  server  were 
printed  without  annotating  the  proper  receipt  date. 

Instead  of  routing  all  facsimiles  directly  into  its  Electronic  Document 
Management  (EDM)  fax  server,  the  DFAS  Directorate  of  Network  Operations 
(DNO),  Indianapolis,  Indiana,  received  documents  supporting  vendor  payments 
on  facsimile  machines  located  throughout  the  vendor  payment  office.  This 
practice  circumvented  the  controls  established  within  EDM  to  electronically 
receive,  date-stamp,  index,  and  route  vendor  payment  documents.  The  lack  of 
proper  control  over  the  receipt  of  supporting  documents  contributed  to  DFAS 
DNO  making  four  duplicate  payments,  valued  at  about  $2.5  million,  from 
May  1  through  July  31,  2000.  In  all  four  instances,  payments  were  processed 
from  hard-copy  documents  that  circumvented  EDM.  Documents  were  received 
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in  the  vendor  pay  office,  used  to  make  the  payments,  and  then  faxed  or  scanned 
into  EDM.  Documents  were  then  indexed  and  routed  to  other  payment  teams 
that  processed  the  duplicate  payments  using  the  supporting  documents  in  EDM. 
DFAS  should  establish  and  enforce  standard  business  rules  on  how  supporting 
documents  will  be  received  within  its  field  sites.  These  business  rules  should 
direct  field  sites  to  receive  all  incoming  documents  in  the  mailroom  or  over  the 
RightFAX  server. 

Date-Stamping.  DFAS  did  not  establish  business  rules  for 
date-stamping  incoming  vendor  pay  documents  that  ensured  that  all  incoming 
documents  were  date-stamped  with  the  actual  date  of  receipt.  The  nine  DFAS 
field  sites  did  not  always  date-stamp  documents  immediately  upon  receipt  or 
with  the  actual  date  of  receipt.  Six  of  the  nine  field  sites  changed  date  stamps  at 
a  specific  time  each  day,  regardless  of  whether  all  vendor  pay  documents 
received  that  day  had  been  stamped  with  the  actual  date  of  receipt.  For 
example,  the  mailroom  at  DFAS  Orlando,  Orlando,  Florida,  changed  date 
stamps  at  noon  daily.  Mail  received  by  the  mailroom  after  noon  was 
date-stamped  with  die  next  business  day’s  date.  During  the  visit,  DFAS 
Orlando  changed  mailroom  procedures  to  ensure  that  vendor  payment 
documents  were  stamped  with  the  actual  dates  of  receipt.  Only  DFAS 
St.  Louis;  DFAS  Rock  Island;  and  DFAS  Rome,  Rome,  New  York,  had 
procedures  in  place  to  ensure  that  the  actual  date  of  receipt  was  placed  on 
incoming  vendor  payment  documents.  These  field  sites  changed  the  date  stamp 
to  the  next  business  day  only  after  all  vendor  payment  documents  received 
reflected  the  actual  date  of  receipt.  DFAS  needs  to  implement  standard  business 
rules  that  ensure  that  vendor  payment  documents,  especially  invoices,  are 
date-stamped  with  the  proper  date  of  receipt. 

Vendor  Payment  Processing.  DFAS  did  not  establish  standard  business  rules 
that  promoted  accurate,  consistent,  and  timely  processing  of  vendor  payments. 
Standard  business  rules  should  describe  how  vendor  payment  offices  should 
manage  documents;  describe  how  to  enter,  compute,  and  certify  payments; 
ensure  that  payments  are  prevalidated;  describe  how  to  add  or  amend  vendor 
maintenance  data;  and  resolve  problems  in  making  vendor  payments. 

Document  Management.  DFAS  had  not  established  consistent  business 
rules  that  defined  procedures  on  how  to  properly  manage  vendor  payment 
documents.  Standard  document  management  practices  ensure  that  all  documents 
used  to  support  vendor  payments  are  consistently  screened,  tracked,  and  entered 
in  CAPS.  Document  management  practices  at  the  nine  DFAS  field  sites  varied 
significantly.  Although  seven  of  the  nine  DFAS  field  sites  had  established  a 
document  management  section,  the  technicians  in  those  sections  did  not 
effectively  or  consistently  screen,  enter,  and  control  documents  supporting 
vendor  payments.  Document  management  sections  need  to  be  established  and 
staffed  with  experienced  vendor  pay  technicians  and  supervisors  who  are 
knowledgeable  of  the  requirements  for  proper  supporting  documents  so  they  can 
promptly  return  improper  documents  and  properly  enter  documents  into  CAPS. 

Screening  and  Returning  Documents.  DFAS  had  not 
developed  or  enforced  standard  business  rules  for  screening  and  returning  all 
supporting  documents  that  did  not  meet  the  requirements  in  5  C.F.R.  Part  1315, 
the  FAR,  and  the  requirements  established  to  support  miscellaneous  payments. 
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Complete  screening  and  prompt  return  of  improper  documents  is  essential  to 
process  properly  supported  payments,  prevent  rework,  and  avoid  unnecessary 
interest  penalties.  As  discussed  in  finding  C,  sample  payments  were  frequently 
not  supported  by  proper  invoices,  receiving  reports,  and  obligation  documents. 
Inconsistencies  existed  in  how  DFAS  field  sites  screened  documents  and 
returned  them  for  correction.  Some  field  sites  routinely  returned  documents  to 
originators  that  did  not  meet  established  requirements.  However,  other  field 
sites  often  accepted  documents  with  similar  errors  as  proper  and  used  them  to 
support  payments.  Individuals  screening  payment  documents  inappropriately 
determined  that  missing  or  incomplete  items  of  information  on  documents  were 
only  minor  administrative  errors  that  should  not  delay  the  payments. 

Invoices.  Invoices  supporting  payments  often  did  not 
meet  the  requirements  of  5  C.F.R.  Part  1315,  the  FAR,  and  DoD  Regulation 
7000. 14-R,  volume  10  (see  Appendix  D).  Invoices  not  meeting  requirements 
should  be  returned  to  the  vendor  for  correction  within  7  days  of  receipt  at  either 
the  DFAS  field  site  or  the  billing  office  designated  in  the  contract.  The 
practices  followed  by  the  nine  DFAS  field  sites  for  returning  improper  invoices 
varied  and  did  not  fully  comply  with  established  procedures.  For  example, 
while  DFAS  Europe  had  procedures  that  required  document  control  technicians 
to  screen  and  return  improper  invoices,  they  were  not  consistently  followed. 
Instead  of  returning  invoices,  vendor  pay  technicians  at  DFAS  Norfolk  changed 
or  added  contract  numbers  on  invoices  and  used  the  altered  documents  to 
process  payments.  DFAS  Rock  Island  and  DFAS  St.  Louis  inappropriately 
relumed  invoices  to  vendors  because  they  had  not  received  receiving  reports  or 
contracts.  Unless  the  vendor  payment  office  first  verifies  that  the  vendor  did 
not  ship  the  goods  or  render  the  service,  invoices  that  are  proper  for  payment 
should  be  entered  and  controlled  in  CAPS.  DFAS  needs  to  establish  standard 
business  rules  for  screening  invoices  and  enforce  requirements  for  returning 
improper  invoices  to  vendors. 

Receiving  Reports.  Vendor  payment  technicians  at  all 
nine  DFAS  field  sites  did  not  adequately  review  receiving  reports  to  determine 
whether  they  met  the  requirements  in  5  C.F.R.  Part  1315.  Receiving  reports 
missing  required  information  should  be  immediately  returned  to  receiving 
activities  for  correction.  Timely  return  and  correction  of  receiving  reports  is 
essential  to  avoid  unneeded  rework  and  unnecessary  interest  payments. 

Contracts  and  Authorization  Documents.  Only  four 
DFAS  field  sites  had  procedures  in  place  for  returning  incomplete  contracts  to 
contracting  offices  for  correction.  Contracting  information  to  support  vendor 
payments  must  meet  5  C.F.R.  Part  1315  to  properly  support  a  payment.  A 
proper  contract  or  other  authorization  document  obligating  the  Government  to 
pay  an  individual  or  vendor  should  support  every  vendor  payment.  Some 
contracts  did  not  provide  payment  terms  or  an  adequate  description  of  the  item 
or  services  procured.  The  lack  of  this  information  caused  technicians  to  guess 
what  was  meant.  Contracts  were  also  missing  required  clauses  such  as  the 
Central  Contractor  Registry  (CCR)/EFT  clause.  Authorization  documents  that 
supported  miscellaneous  payments  also  lacked  needed  information.  Technicians 
were  reluctant  to  return  incomplete  contracts  to  contracting  offices.  Business 
rules  should  require  that  contracts  provide  the  information  contained  at  5  C.F.R. 
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Part  1315  and  as  specified  for  prompt  payments  in  the  revised  FAR 
subpart  32.9.  Standard  business  rules  should  also  be  established  for  screening 
and  returning  authorization  documents  that  support  miscellaneous  payments. 

Tracking  Documents.  DFAS  did  not  have  standard  business 
rules  on  how  to  track  documents  supporting  vendor  payments  received  at  field 
sites  from  the  time  of  receipt  until  payment.  Maintaining  positive  control  over 
supporting  documents  prevents  documents  from  being  lost.  Eight  of  the  nine 
DFAS  field  sites  had  methods  of  tracking  documents.  However,  none  of  the 
field  sites  efficiently  and  effectively  controlled  all  documents  supporting  vendor 
payments.  For  example, 

•  DFAS  San  Antonio  used  bar  codes  and  scanners  that  fed  information 
into  an  access  database  to  track  the  location  of  each  contract  folder. 

•  DFAS  San  Antonio  did  not  have  a  mechanism  in  place  to  track 
invoices,  receiving  reports,  and  documents  supporting  miscellaneous 
payments. 

•  DFAS  Europe  created  a  database  to  track  supporting  documents  and 
contract  folders. 

Entering  information  into  multiple  spreadsheets  or  a  separate  database  created 
additional  workload  that  most  field  sites  did  not  have  the  staff  to  support. 

DFAS  Lawton,  Lawton,  Oklahoma,  had  the  most  effective  method  of 
maintaining  positive  control  over  documents  supporting  contract  payments. 
DFAS  Lawton  placed  input  technicians  in  the  document  management  area  and 
established  a  standard  of  3  business  days  for  entering  documents  in  CAPS. 

DFAS  should  implement  an  efficient  and  effective  method  of  tracking 
supporting  documents  received  by  the  field  sites.  The  method  should  provide 
field  sites  with  the  ability  to  track  all  supporting  documentation  throughout  the 
entire  payment  process  without  creating  an  unmanageable  workload  for  the 
vendor  payment  office. 

Data  Entry.  DFAS  field  sites  did  not  enter  payment  information 
into  CAPS  consistently,  accurately,  or  timely.  At  the  nine  DFAS  field  sites,  we 
randomly  selected  invoices,  receiving  reports,  and  obligating  documents  from 
the  mailroom  and  traced  them  through  the  vendor  payment  process.  The  time  it 
took  for  documents  to  be  entered  into  CAPS  ranged  from  1  to  30  days.  The 
lack  of  effective  procedures  for  entering  documents  at  DFAS  field  sites 
significantly  contributed  to  delays  in  making  payments.  For  example,  vendor 
payment  technicians  at  DFAS  Norfolk  placed  invoices  and  receiving  reports  in 
contract  files  and  did  not  enter  information  into  CAPS  until  all  documents 
supporting  the  payment  were  received  at  the  field  site.  The  need  to  manually 
enter  contract  information  into  CAPS  was  also  a  factor  that  delayed  the  payment 
process.  As  discussed  in  finding  B,  continuing  problems  prevent  the  interface 
of  Army  contract  data  between  die  Standard  Procurement  System  (SPS)  and 
CAPS.  DFAS  field  sites  were  also  prohibited  from  using  Electronic  Document 
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Access  (EDA)1  to  obtain  contract  data  for  entry  into  CAPS.  DFAS  Rome  had 
contracting  offices  that  provided  reliable  contract  data  in  EDA;  however,  the 
field  site  was  not  permitted  to  use  the  data.  DFAS  should  develop  and 
implement  standard  business  rules  for  entering  documents  needed  to  support 
contract  and  miscellaneous  payments.  Standard  business  rules  for  entering  data 
into  CAPS  are  necessary  to  process  proper  payments,  maintain  positive  control 
over  the  payment  process,  and  reduce  rework  and  interest  payments. 

Payment  Computation.  DFAS  did  not  implement  standard  business 
rules  for  computing  payments  and  ensuring  that  payments  were  prevalidated. 
Segregating  the  compute  function  from  data  entry  provides  an  additional  review 
of  the  data  to  ensure  that  payments  are  properly  supported  prior  to  certification. 

Computing  Payments.  DFAS  did  not  establish  standard 
procedures  for  computing  vendor  payments.  Vendor  pay  technicians  did  not 
consistently  review  all  supporting  documents,  compare  them  to  the  information 
entered  into  CAPS,  and  compute  payments  for  disbursement.  Generally,  the 
technicians  were  not  very  thorough  in  their  review  of  payment  information. 
However,  at  DFAS  Lawton,  technicians  reviewed  supporting  documents  for 
compliance  with  the  contract,  thoroughly  reviewed  information  entered  into 
CAPS  for  any  data  entry  errors,  and  verified  the  vendor  EFT  information  in  the 
Corporate  EFT  (CEFT)  database  before  computing  the  payment  voucher.  The 
other  DFAS  field  sites  did  not  follow  similar  procedures. 

Prevalidation  of  Payments.  DFAS  field  sites  did  not  establish 
effective  procedures  for  prevalidating  disbursements.  DoD  Regulation 
7000. 14-R,  volume  3,  chapter  11,  “Unmatched  Disbursements,  Negative 
Unliquidated  Obligations,  In-Transit  Disbursements,  and  Suspense  Accounts,” 
January  2001,  requires  that  disbursements  be  matched  to  corresponding 
obligations  recorded  in  the  official  accounting  records  before  making  payments. 
DFAS  San  Antonio  stopped  prevalidating  payments  due  to  backlogs  in  making 
payments  and  staffing  issues  in  the  vendor  payment  area.  The  other  DFAS  field 
sites  attempted  to  pre validate  contract  payments,  but  not  all  miscellaneous 
payments.  The  DFAS  field  sites  that  attempted  to  prevalidate  contract  payments 
did  not  consistently  ensure  that  a  corresponding  obligation  existed  in  accounting 
records  and  had  limited  assurance  that  a  duplicate  payment  would  not  be  made. 
For  example, 

•  DFAS  DNO  paid  a  vendor  $1.29  million  on  June  27,  2000, 
for  contracted  services.  A  second  payment  was  paid  on 
July  19,  2000,  for  the  same  amount  to  the  same  vendor.  The 
duplicate  payment  was  not  identified  during  the  prevalidation 
process  because  funds  were  not  reserved  in  the  accounting 
system  when  the  payment  was  prevalidated.  DFAS  DNO 
subsequently  recovered  the  second  payment. 


:EDA  is  an  Internet  based  system  designed  to  replace  the  paper  version  of  contract  documents  with  an 
electronic  version. 
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•  DFAS  Europe  made  payments  after  attempting  to  prevalidate 
the  payment  at  least  five  times,  even  if  the  prevalidation 
report  generated  by  the  Vendor  Payment  Prevalidation 
Program  showed  that  funds  were  not  available  to  cover  the 
payment.  While  four  of  the  payment  teams  at  DFAS  Europe 
used  reports  generated  by  the  Vendor  Payment  Prevalidation 
Program,  three  other  teams  manually  prevalidated  payments 
by  viewing  information  in  the  accounting  system. 

The  Vendor  Payment  Prevalidation  Program  used  by  DFAS  field 
sites  to  prevalidate  disbursements  was  not  effective  in  eliminating  problem 
disbursements  and  duplicate  payments  because  funds  were  not  reserved  in  the 
accounting  system  at  the  time  the  payment  was  prevalidated.  The  available  fund 
balance  in  the  accounting  system  was  not  reduced  until  after  the  payment  was 
actually  disbursed  and  the  transaction  transferred  and  recorded  in  the  accounting 
system.  The  lag  time  between  the  date  the  payment  is  prevalidated  and  the  date 
the  disbursement  is  recorded  in  the  accounting  system  allows  duplicate  payments 
to  be  made.  DFAS  must  implement  standard  business  rules  that  include 
procedures  for  properly  prevalidating  all  vendor  payments. 

Certification  of  Payments.  DFAS  had  not  developed  and  enforced 
standard,  effective  business  rules  for  certifying  vendor  payments.  Payments 
need  to  be  properly  certified  to  ensure  that  all  payments  are  legal,  correct,  and 
properly  supported  before  being  disbursed. 

Certification  Procedures.  Certification  procedures  varied  at  the 
nine  DFAS  field  sites  and  certifying  officials  did  not  ensure  that  all  payments 
were  legal,  correct,  and  proper  before  being  disbursed.  Certification  officials 
often  did  not  thoroughly  review  the  documents  supporting  the  vendor  payments 
or  check  the  vendors’  EFT  information  in  CAPS  against  the  CCR/CEFT 
information  before  certifying  each  payment.  For  example: 

•  DFAS  Lawton  certified  payments  that  were  remotely  processed  by 
Army  installation  personnel  without  reviewing  the  supporting 
documentation  that  was  entered  in  CAPS  and  retained  at  the 
installations. 

•  At  DFAS  Rome  and  DFAS  Europe,  certification  officials  did  not 
review  the  EFT  information  in  CAPS  before  certifying  the  payments. 

•  Certification  officials  at  DFAS  Rock  Island  only  compared 
information  in  CAPS  to  the  information  on  the  disbursement  voucher 
before  uploading  the  payment  from  CAPS  to  the  Operational  Data 
Store  (ODS)  for  subsequent  disbursement  in  the  Standard  Financial 
System  Redesign. 

Supporting  documentation  was  not  reviewed  for  compliance  and  the  certifying 
officials’  signatures  were  not  affixed  to  the  vouchers.  As  discussed  in 
finding  C,  certification  officials  often  did  not  detect  improperly  supported  and 
erroneous  payments.  DFAS  should  have  established  and  enforced  strict 
business  rules  to  ensure  that  certification  officials  are  thoroughly  reviewing 
information  supporting  payments  and  signing  all  disbursement  vouchers. 
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Upload  of  Payment  Data  to  ODS.  DFAS  did  not  establish 
standard  procedures  for  transferring  information  on  certified  payments  from 
CAPS  to  ODS  and  providing  assurance  to  the  disbursing  officer  that  all 
payments  were  certified.  Payment  information  was  transferred  from  CAPS  to 
ODS  by  downloading  the  information  from  CAPS  to  a  disk  and  uploading 
information  from  the  disk  to  ODS.  The  payment  information  downloaded  from 
CAPS  to  the  disk  was  not  an  encrypted  file.  Consequently,  payment 
information  on  the  disk  could  be  altered  without  having  to  be  recertified  before 
uploading  it  to  ODS.  Once  the  payment  information  was  uploaded  to  ODS,  it 
was  electronically  transferred  to  the  Standard  Financial  System  Redesign  and 
disbursed  by  the  central  disbursing  office.  Individuals  at  the  DFAS  field  sites 
responsible  for  transferring  payment  information  between  CAPS  and  ODS  were 
either  vendor  pay  technicians,  team  supervisors,  or  systems  personnel.  The 
payment  office  did  not  provide  evidence  to  the  disbursing  officer  in  the  central 
disbursing  office  that  payments  had  been  certified.  The  disbursing  officer  relied 
on  the  system  data  as  proof  of  certification  even  though  it  was  possible  to  alter 
the  information  on  the  disk.  To  improve  the  integrity  of  the  certification  and 
upload  process,  certification  officials  should  be  responsible  for  transferring  the 
payment  information  from  CAPS  to  ODS  and  provide  the  disbursing  officer 
with  proof  that  the  transferred  payments  have  been  certified. 

Reports  and  Reconciliation.  DFAS  did  not  establish  standard  business 
rules  at  field  sites  for  obtaining  documents  needed  to  make  vendor  payments  and 
updating  vendor  remittance  tables  within  CAPS.  Business  rules  should  provide 
guidelines  for  the  reports  and  reconciliation  section  to  work  with  the  Army  and 
Defense  agencies  to  obtain  needed  documents  and  to  input  and  maintain  vendor 
information  in  CAPS. 

Obtaining  Documents.  Procedures  for  obtaining  missing 
supporting  documents  differed  at  each  DFAS  field  site  and  were  not  always 
effective.  Some  field  sites  emphasized  the  need  to  conduct  research  and  obtain 
missing  supporting  documents  by  designating  individuals  or  separate  teams  to 
complete  research  and  obtain  supporting  documents.  Creating  a  separate  team 
or  designating  an  employee  to  conduct  research  proved  more  efficient  and 
effective  than  having  the  individuals  responsible  for  processing  payments  also 
conduct  research.  Conducting  research  and  contacting  customers  was  time- 
consuming,  kept  vendor  pay  technicians  from  processing  payment  information, 
and  slowed  down  the  payment  process.  The  time  consumed  in  accomplishing 
research  and  the  delay  in  the  payment  can  result  in  unnecessary  interest 
payments. 


Invoices  Without  Receiving  Reports.  DFAS  did  not  have 
standard  procedures  in  place  to  aggressively  work  with  receiving  activities  to 
obtain  missing  documents.  A  significant  cause  of  interest  payments  made  by 
field  sites  was  due  to  the  inability  to  obtain  proper  receiving  reports  from 
receiving  activities  at  installations.  CAPS  generated  a  listing  called  “Invoices 
Without  Receiving  Reports.  ”  The  listing  identified  invoices  that  had  been 
received  but  were  not  scheduled  for  payment  until  receipt  of  corresponding 
receiving  reports.  The  use  of  the  listing  varied  significantly  at  each  DFAS  field 
site  we  visited.  The  field  sites  that  aggressively  worked  the  listing  and 
communicated  effectively  with  customers  had  the  lowest  number  of  invoices 
over  30  days  old.  DFAS  Rome  and  DFAS  St.  Louis  had  individuals  dedicated 
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to  working  the  listing,  sending  information  to  the  appropriate  activities,  and 
calling  and  requesting  information  from  receiving  activities.  Field  sites  such  as 
DFAS  San  Antonio  and  DFAS  DNO,  did  not  aggressively  work  the  listing. 
DFAS  and  Army  financial  managers  need  to  work  together  to  ensure  that 
receiving  reports  for  goods  and  services  are  obtained  promptly  upon  receipt  and 
acceptance  of  goods  and  services. 

Updating  Vendor  Remittance  Data.  DFAS  field  sites  were 
inconsistent  in  verifying  information  in  the  CCR/CEFT  database  and  ensuring 
that  payments  were  sent  as  required  via  EFT.  Technicians  at  DFAS  DNO  and 
DFAS  Norfolk  inappropriately  sent  check  payments  to  vendors  who  should  have 
been  registered  in  the  CCR/CEFT  database.  Sending  check  payments  to 
vendors  who  were  not  exempt  from  registering  in  the  CCR/CEFT  database  was 
contrary  to  the  Debt  Collection  Improvement  Act  of  1996.  Although  DFAS 
Norfolk  and  DFAS  DNO  alerted  vendors  of  the  need  to  register  in  the  CCR, 
neither  field  site  withheld  payments  or  followed  up  to  ensure  that  vendors 
registered  after  receiving  die  notifications.  DFAS  Rome  created  a  separate  EFT 
team  to  process  and  research  vendor  information;  however,  CAPS  access  was 
not  appropriately  restricted.  Not  verifying  and  obtaining  vendor  information 
from  die  CCR/CEFT  database  for  all  payments  increased  the  risk  that  payments 
would  be  made  to  incorrect  payees.  Business  rules  should  require  that 
technicians  verify  information  in  the  CCR/CEFT  database  and  ensure  that 
payments  are  sent  as  required  via  EFT. 

Summary  of  the  Need  for  Standard  Business  Rules.  DFAS  needs  to 
establish  and  enforce  standard  business  rules  to  create  an  environment  conducive 
to  processing  accurate  and  proper  payments.  The  standard  business  rules  should 
complement  a  standard  office  structure  and  be  incorporated  in  DoD 
Regulation  7000. 14-R,  volume  10.  Business  rules  should  include  procedures  for 
receiving  and  date-stamping  incoming  documents  in  a  secure  location  outside  the 
vendor  payment  office.  Personnel  in  vendor  payment  offices  should  also  ensure 
that  documents  supporting  payments  are  adequately  screened  and  controlled  and 
payments  are  computed  correctly  and  properly  prevalidated.  Organizationally 
independent  individuals  should  certify  that  payments  are  legal,  proper,  and 
correct  for  payment.  Business  rules  should  also  define  standard  procedures  for 
transferring  payment  data  between  CAPS  and  ODS  and  verifying  that  payments 
transmitted  to  disbursing  officers  were  certified.  Methods  for  verifying 
information  in  the  CCR/CEFT  database  and  ensuring  that  payments  are  sent  as 
required  via  EFT  should  also  be  defined  in  business  rules.  Enforcement  of 
standard  business  rules  helps  to  ensure  that  vendor  payments  are  processed 
consistently  and  accurately  and  reduces  the  risk  of  making  erroneous  or 
improperly  supported  payments. 

Monitoring  the  Payment  Process 


DFAS  did  not  take  advantage  of  best  business  practices  and  management 
oversight  was  not  effective  in  detecting  control  weaknesses  and  improving  the 
vendor  payment  process.  In  addition,  managers  were  not  provided  with  die 
information  they  needed  to  identify  and  correct  weaknesses  in  the  vendor 
payment  process.  As  a  result,  DFAS  field  sites  continued  to  make  duplicate  and 
improperly  supported  payments  and  worked  individually  to  develop  monitoring 
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tools.  Oversight  tools  and  programs  should  be  implemented  that  detect 
weaknesses  in  the  processing  of  vendor  payments,  perform  root  cause  analysis, 
and  develop  appropriate  corrective  actions. 

Local  Initiatives.  DFAS  did  not  share  best  business  practices  developed  by 
field  sites.  Many  field  sites  developed  effective  reporting  and  monitoring  tools 
designed  to  improve  business  operations.  For  example,  DFAS  Rome  focused 
on  obtaining  missing  receiving  reports  and  developed  reporting  tools  to 
effectively  communicate  and  electronically  submit  information  to  receiving 
activities.  DFAS  Orlando  focused  on  the  importance  of  limiting  systems  access 
and  developed  a  computer  program  to  streamline  system  access  reviews. 
Unfortunately,  we  did  not  find  that  these  locally-developed  tools  were  shared 
with  other  field  sites.  Reporting  and  monitoring  tools  should  be  shared  with 
other  field  offices  in  order  to  improve  the  processing  of  vendor  payments. 

Identifying  and  Tracking  Payment  Problems.  DFAS  did  not  effectively 
implement  the  software  application  that  was  designed  to  identify  potential 
duplicate  payments,  perform  frequent  and  thorough  reviews  of  payments,  and 
track  progress  in  reducing  erroneous  payments. 

Predator.  DFAS  San  Antonio  was  the  only  field  site  properly 
administering  the  Predator  software  application.  The  other  eight  DFAS  field 
sites  either  were  not  using  the  software  application  or  were  not  using  it 
correctly.  While  we  could  not  determine  the  total  dollar  value  of  duplicate 
payments  made  by  the  DFAS  field  sites,  we  identified  at  least  $13.2  million  in 
duplicate  payments. 

•  DFAS  Europe  claimed  the  software  application  was  not  working  and 
had  stopped  generating  Predator  reports.  We  obtained  a  Predator 
report  that  DFAS  Europe  did  not  analyze  and  easily  identified  a 
potential  duplicate  payment  of  $120,344.80.  DFAS  Europe 
subsequently  voided  the  scheduled  payment.  The  potential  existed 
that  many  additional  duplicate  payments  were  on  the  report.  In  its 
draft  report,  “Operational  Review  Europe,”  dated  May  27,  2001,  the 
DFAS  Internal  Review  team  identified  that  DFAS  Europe  had  made 
226  duplicate  payments,  valued  at  about  $2  million.  Many  of  the 
duplicate  payments  were  on  the  Predator  report  we  reviewed. 

•  Instead  of  running  Predator  daily,  DFAS  DNO  ran  the  software 
application  on  a  monthly  basis.  The  Predator  report  provided  to  us 
identified  six  actual  duplicate  payments  totaling  $7,662.57.  Based  on 
other  reports  obtained  from  DFAS  DNO,  about  $8.5  million  in 
duplicate  payments  were  made  from  March  1999  through  May  2001. 
An  additional  four  duplicate  payments,  valued  at  $2.5  million, 
discussed  on  page  4  of  this  report  were  not  identified  on  the  Predator 
report  or  the  reports  obtained  from  DFAS  DNO. 

•  Individuals  responsible  for  administering  Predator  at  DFAS  Rock 
Island  had  not  been  properly  trained.  Consequently,  dates  were 
incorrectly  entered  in  the  search  parameters  when  the  software 
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application  was  used.  After  they  adjusted  the  search  parameters  at 
our  request,  DFAS  Rock  Island  identified  six  duplicate  payments 
totaling  $194,418.24. 

When  administered  properly,  Predator  is  effective  in  identifying  potential 
duplicate  payments.  Potential  duplicate  payments  must  be  researched  and 
appropriate  actions  taken  on  each  payment.  The  tools  in  Predator  should  be 
used  to  track  results  and  generate  reports  useful  to  management  in  identifying 
and  correcting  payment  problems.  DFAS  should  send  out  a  team  to  each  of  the 
field  sites  to  ensure  that  the  Predator  application  is  properly  installed,  provide 
training  to  individuals  running  Predator,  and  assist  in  researching  the  results  of 
the  initial  use  of  the  software  application. 

Post-Payment  Voucher  Reviews.  DFAS  did  not  perform  adequate 
reviews  to  ensure  that  certified  payments  were  legal,  proper,  and  correct  for 
payment.  DFAS  Indianapolis  designated  a  team  to  conduct  post-payment 
voucher  reviews  at  each  field  site  once  a  year.  Statistical  samples  of  payments 
were  selected  from  one  quarter  of  the  fiscal  year  and  reviewed  by  the  team  for 
compliance  with  the  DoD  Regulation  7000. 14-R,  volume  10;  DFAS 
Indianapolis  Regulation  37-1,  chapter  9,  “Vendor  Pay,”  January  2000;  and  the 
FAR  Part  32.905(F).  While  DoD  Regulation  7000. 14-R,  volume  5,  does  not 
identify  the  frequency  of  the  post-payment  reviews,  we  believe  that  they  should 
be  performed  monthly  to  ensure  that  payment  errors  are  promptly  identified, 
training  is  provided  in  areas  where  problems  are  recurrent,  and  progress  in 
correcting  problems  can  be  tracked. 

Performance  Measures.  DFAS  did  not  track  the  number  and  dollar 
value  of  duplicate  payments  identified  by  the  Predator  software  application  and 
erroneous  vendor  payments  actually  made  by  field  sites.  Performance 
Management  Indicator  reports  were  designed  by  DFAS  to  monitor  and  help 
improve  network  operations.  The  monthly  reports  completed  by  each  field  site 
identified  such  items  as  the  number  of  overaged  invoices;  the  number  of 
contracts,  invoices,  and  receiving  reports  entered  in  CAPS;  interest  penalties; 
and  discounts  lost  and  taken.  DFAS  set  standards  for  items  it  monitored  and 
required  field  sites  failing  to  meet  standards  to  develop  a  plan  detailing  the 
problem  areas,  causes,  planned  corrective  actions,  and  expected  dates  of 
resolution.  DFAS  did  not  track  duplicate  payments  identified  by  the  Predator 
software  application  and  other  erroneous  payments  made  by  field  sites.  Without 
a  means  of  measuring  the  extent  of  the  problems,  DFAS  managers  cannot 
determine  if  the  problems  are  significant  enough  to  require  corrective  action, 
how  much  to  spend  to  correct  the  problems,  or  the  impact  of  the  actions  taken. 
DFAS  should  require  the  reporting  of  information  on  duplicate  payments 
identified  by  the  Predator  software  application  and  other  erroneous  payments 
made  by  field  sites.  The  results  should  be  used  to  gain  an  understanding  of 
recurring  problems  and  to  develop  corrective  actions. 

Summary 


A  standard  office  structure  and  standardized  business  rules  for  making  vendor 
payments  would  promote  a  strong  internal  control  environment  and  reduce  the 
number  of  improperly  supported  payments  and  the  payments  that  should  not 
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have  been  made.  In  such  an  environment,  documents  will  be  controlled  better, 
information  in  CAPS  will  be  properly  supported,  and  vendors  will  be  paid  more 
timely  and  for  the  correct  amount.  DFAS  and  the  Army  must  make  a  concerted 
effort  to  ensure  that  proper  receiving  reports  are  obtained  promptly  upon  receipt 
and  acceptance  of  goods  and  services.  To  maintain  proper  segregation  of 
duties,  DFAS  should  make  sure  that  no  one  individual  can  enter  or  direct  the 
entry  of  all  data  needed  to  make  payments  and  certification  officials  are 
organizationally  independent.  More  also  needs  to  be  done  to  take  full  advantage 
of  best  business  practices  and  improve  visibility  over  problems  in  processing 
vendor  payments. 

Recommendations,  Management  Comments,  and  Audit 
Response 


A.l.  We  recommend  that  the  Under  Secretary  of  Defense  (Comptroller),  in 
coordination  with  the  Director,  Commercial  Pay  Services,  develop  and 
incorporate  into  DoD  Regulation  7000. 14-R,  volume  10,  standard  business 
rules  for  making  vendor  payments.  The  rules  must  incorporate  the 
requirements  of  5  Code  of  Federal  Regulations  Part  1315,  the  Debt 
Collection  Improvement  Act  of  1996,  and  pending  changes  to  the  Federal 
Acquisition  Regulation. 

Under  Secretary  of  Defense  (Comptroller)  Comments.  The  Acting  Deputy 
Chief  Financial  Officer  stated  that  his  office  has  begun  to  revise  DoD 
Regulation  7000. 14-R,  volume  10,  to  incorporate  pertinent  aspects  of  5  C.F.R. 
Part  1315  and  the  Debt  Collection  Improvement  Act  of  1996.  The  updated  DoD 
Regulation  7000. 14-R,  volume  10,  is  to  be  issued  following  receipt  and 
consideration  of  the  remaining  comments  from  the  DoD  Components. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially 
concurred  and  stated  that  DFAS  would  work  with  the  Under  Secretary  of 
Defense  (Comptroller)  on  appropriate  changes  to  DoD  Regulation  7000. 14-R, 
volume  10.  The  Director  stated  that  a  vendor  pay  standardization  study  was 
conducted  that  also  recognized  the  need  for  standard  practices.  The  Director 
stated  that  detailed  processes  unique  to  specific  vendor  payment  offices  would 
not  be  incorporated  into  DoD  Regulation  7000. 14-R,  volume  10. 

Audit  Response.  The  Under  Secretary  of  Defense  (Comptroller)  comments 
were  partially  responsive.  The  pending  change  to  DoD  Regulation  7000. 14-R, 
volume  10,  should  incorporate  the  requirements  in  5  C.F.R.  Part  1315  and  the 
Debt  Collection  Improvement  Act  of  1996.  However,  DoD  Regulation 
7000. 14-R,  volume  10,  should  also  incorporate  standard  business  rules  for 
screening,  tracking,  controlling,  entering,  prevalidating,  certifying,  and 
researching  problems  with  most  types  of  vendor  payments.  The  DFAS 
comments  were  responsive.  Publishing  guidance  on  unique  processes  in  another 
document  would  be  appropriate.  We  request  that  the  Under  Secretary  of 
Defense  (Comptroller)  provide  additional  comments  that  address  standardizing 
business  rules  in  DoD  Regulation  7000. 14-R,  volume  10.  The  additional 
comments  should  also  provide  an  estimated  completion  date  for  the  actions  taken 
or  planned. 
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A.2.  We  recommend  that  the  Director,  Commercial  Pay  Services,  improve 
the  identification  and  correction  of  problems  in  making  vendor  payments 
by: 


a.  Identifying  the  best  practices  used  by  vendor  payment  offices  to 
detect  weaknesses  in  the  vendor  payment  process  and  designating  those  best 
practices  as  standard  reporting  and  monitoring  tools. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  20  recommended  changes  for  standardization  resulted  from  the 
vendor  pay  standardization  study.  Vendor  Pay  Support  Directors  will 
implement  agreed-upon  recommendations.  The  review  of  best  practices  will  be 
an  ongoing  topic  of  discussion  at  the  quarterly  meetings  with  Vendor  Pay 
Support  Directors. 

b.  Verifying  that  the  Predator  software  application  has  been 
properly  installed  at  all  field  sites  and  providing  individuals  who  run  the 
Predator  software  with  sufficient  training. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially 
concurred  and  stated  that  the  Predator  software  application  produces  a  high 
number  of  potential  duplicate  payments  that  prove  to  be  valid  payments  after 
taking  an  inordinate  amount  of  time  to  review.  The  Director  will  compare  the 
edits  and  query  capabilities  in  the  Standard  Account  and  Reporting  System  One 
Pay  system  to  the  Predator  software  to  determine  whether  the  Predator  software 
should  be  fielded  by  the  Navy  support  sites.  The  Director  also  stated  that 
improvements  to  the  Predator  software  would  be  made  in  May  2002. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  While  many 
of  the  reports  generated  by  the  Predator  software  application  were  voluminous, 
reviews  at  the  DFAS  field  sites  showed  that  the  Predator  software  was  not  being 
used  properly  and  individuals  responsible  for  using  the  software  were  not 
adequately  trained  on  its  use.  As  part  of  the  effort  to  improve  the  ability  of  the 
Predator  software  to  screen  potential  duplicate  payments,  DFAS  should  ensure 
that  each  field  site  properly  installs  the  upgraded  software  and  users  understand 
how  to  use  it.  We  request  that  DFAS  reconsider  its  position  and  provide 
additional  comments  addressing  the  need  to  properly  install  the  software  and 
provide  sufficient  training  to  users. 

c.  Performing  monthly  post-payment  voucher  reviews  to  ensure  that 
payments  are  legal,  proper,  and  correct  for  payment. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially 
concurred  and  stated  that  DoD  Regulation  7000. 14-R,  volume  5,  does  not 
establish  the  frequency  of  the  post-payment  reviews.  The  Director  stated  that 
annual  reviews  are  scheduled  at  all  vendor  pay  sites.  When  the  error  rate  drops 
below  95  percent  then  followup  reviews  will  be  conducted. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  In  response 
to  Inspector  General,  DoD,  Report  No.  D-2002-008,  the  Director,  Commercial 
Pay  Services,  stated  that  quarterly  reviews  would  revert  to  monthly  if  an 
unacceptable  level  of  compliance  occurred.  Post-payment  reviews  that  assess 
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strict  compliance  with  the  requirements  in  5  C.F.R.  Part  1315  should  be 
performed  at  least  quarterly.  Field  sites  not  meeting  these  requirements  should 
require  more  frequent  review  until  the  reviews  indicate  that  acceptable  levels  of 
compliance  have  been  achieved.  We  request  that  DFAS  reconsider  its  position 
and  provide  additional  comments  to  the  final  report. 

d.  Establishing  performance  measures  that  will  track  the  number 
and  dollar  value  of  duplicate  payments  and  other  erroneous  payments. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  new  performance  measures  indicators  would  be  developed  by 
June  28,  2002,  to  monitor  duplicate  and  other  erroneous  payments. 
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B.  System  Access  and  Other 
Control  Issues 

Access  to  CAPS(W)  and  CAPS  Clipper  was  not  adequately  controlled 
and  monitored.  System  access  controls  did  not  properly  segregate 
duties,  access  to  payment  functions  was  not  consistently  assigned  to 
payment  technicians  at  DFAS  field  sites,  and  remote  users  were  given 
inappropriate  access  to  CAPS(W).  Problems  existed  because: 

•  standard  access  profiles  were  not  centrally  developed, 
maintained,  and  controlled  to  complement  a  standard  business 
structure; 

•  DFAS  did  not  approve  funding  for  the  changes  needed  to 
correct  known  system  control  weaknesses; 

•  system  functionality  did  not  provide  for  remote  user  access; 
and 

•  effective  system  interfaces  did  not  exist. 

As  a  result,  CAPS  was  susceptible  to  improper  and  unauthorized  use  and 
individual  users  could  circumvent  the  requirements  of  5  C.F.R. 

Part  1315. 

Guidance  and  System  Functionality 

GAO  Report  No.  GAO/AIMD-OO-21.3. 1,  “Standards  for  Internal  Control  in  the 
Federal  Government,”  requires  access  restrictions  and  segregation  of  key  duties 
in  authorizing,  processing,  recording,  and  reviewing  transactions.  The  National 
Computer  Security  Center  has  issued  guidance  on  controlling  passwords  and 
assessing  controlled  access  protection.  The  functionality  of  CAPS(W)  provides 
DFAS  with  the  flexibility  to  assign  specific  payment  functions  to  users  based  on 
assigned  responsibilities  of  vendor  payment  personnel.  The  payment  functions 
can  be  further  limited  to  allow  a  user  to  only  add,  delete,  update,  or  inquire 
about  the  payment  data  in  CAPS(W).  DFAS  used  CAPS  Clipper  to  make 
payments  at  the  DFAS  field  sites  in  Europe,  Rock  Island,  and  St.  Louis  because 
CAPS(W)  could  not  interface  with  certain  accounting  systems  or  handle  foreign 
currency  transactions.  The  54  USPFOs  also  used  CAPS  Clipper  to  make 
vendor  payments. 

System  Access  Within  CAPS(W) 


System  access  profiles  were  not  centrally  controlled  and  monitored.  The  system 
access  profiles  developed  by  the  DFAS  field  sites  using  CAPS(W)  did  not 
adequately  segregate  payment  functions.  To  ensure  strong  management  control 
over  the  vendor  payment  process,  DFAS  needs  to  complement  the  development 
of  a  standard  business  structure  and  business  rules  with  system  access  profiles 
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that  sufficiently  segregate  duties  for  making  payments.  The  profiles  should 
segregate  the  ability  to  enter  payment  data,  compute  payments,  and  certify 
payments  and  be  consistently  assigned  at  each  field  site.  In  addition,  the  ability 
to  add  or  update  data  within  the  vendor  maintenance  function  must  be 
segregated  from  the  other  functions  and  be  granted  to  a  limited  number  of 
individuals. 

System  Access  Profiles.  DFAS  system  and  vendor  payment  managers  did  not 
establish  standard  system  access  profiles  or  take  other  appropriate  actions  to 
adequately  control  access  to  CAPS(W).  System  managers  at  DFAS  Indianapolis 
allowed  each  of  the  field  sites  using  CAPS(W)  to  develop  and  maintain  their 
own  system  access  profiles.  In  addition,  system  access  was  not  centrally 
monitored  to  ensure  adequate  separation  of  duties. 

Initial  Site  Visit.  In  August  2000,  we  found  that  system  access  at 
DFAS  Norfolk  was  not  adequately  controlled.  Four  users  had  been  granted  the 
system  access  that  permitted  them  to  enter  payment  information,  compute 
payments,  and  certify  the  payments.  Eighteen  payment  technicians  could  add  or 
update  the  vendor  payment  data  and  compute  the  payment  without  another 
individual  intervening.  Because  technicians  had  access  to  all  payment  functions, 
they  could  also  adjust  the  payment  terms  to  prevent  the  payment  from  paying 
interest.  An  additional  37  individuals  could  change  where  a  payment  was  sent 
and  certify  the  payment.  These  individuals  could  redirect  a  vendor  payment 
without  another  individual  intervening  in  the  process. 

Discussions  with  DFAS  Managers.  In  September  2000,  we  began  to 
hold  meetings  with  system  and  vendor  payment  managers  at  DFAS  Indianapolis 
to  discuss  concerns  with  the  lack  of  segregation  of  duties.  We  concluded  that 
centrally  developed  system  access  profiles  needed  to  be  established  to  better 
segregate  the  payment  functions  assigned  to  technicians  at  field  sites  using 
CAPS(W).  DFAS  managers  agreed  with  the  need  to  establish  standard  system 
access  profiles.  We  discussed  the  need  to  establish  nine  system  access  profiles 
to  segregate  the  following  functions  within  CAPS(W). 

Invoice  Maintenance.  This  function  allows  the  user  to  enter, 
update,  or  delete  the  data  from  an  invoice.  Individuals  with  access  to  this 
payment  function  should  not  be  able  to  certify  payments  or  add  and  update 
vendor  maintenance  data. 

Receiving  Report  Maintenance.  This  function  allows  the  user 
to  enter,  update,  or  delete  information  from  the  receiving  report.  Individuals 
with  access  to  this  payment  function  should  not  be  able  to  certify  payments  or 
add  and  update  vendor  maintenance  data. 

Purchase  Order  Maintenance.  This  function  allows  the  user  to 
enter,  update,  or  delete  contract  and  authorization  data  in  CAPS(W). 

Individuals  with  this  access  should  not  be  able  to  compute  or  certify  payments  or 
add  and  update  vendor  maintenance  data  in  CAPS(W). 

Vendor  Maintenance.  This  function  allows  the  user  to  enter, 
update,  and  delete  the  vendor  maintenance  data  needed  to  process  EFT 
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information  and  check  remittance  data  in  CAPS(W).  Since  individuals  with  this 
access  can  direct  where  a  payment  is  sent,  they  should  not  be  able  to  certify 
payments  or  alter  any  of  the  other  data  needed  for  making  payments. 

Compute.  This  function  allows  the  user  to  combine  the  data 
entered  from  invoices,  receiving  reports,  and  contracts  or  other  authorization 
documents  and  compute  the  payment  due  date  and  any  interest  payments  owed 
the  vendor.  This  function  should  be  assigned  to  technicians  within  the  contract 
or  miscellaneous  payment  teams  who  can  compare  the  data  entered  by  the  input 
technician  and  ensure  that  the  data  meet  the  requirements  for  payment.  These 
technicians  should  also  verify  that  EFT  information  and  check  remittance  data 
are  correctly  entered  by  comparing  it  to  the  CEFT  database.  However,  they 
should  not  be  able  to  update  payment  data  within  CAPS(W)  or  certify  the 
payment. 


Certify.  This  function  allows  the  user  to  certify  the  payment  and 
upload  the  payment  to  disbursing.  This  function  should  be  assigned  to  users  that 
are  approved  certification  officials.  Certification  officials  should  not  be  able  to 
add,  update,  delete,  or  compute  the  payment  data. 

System  Access  Profiles  at  DFAS  Field  Sites.  DFAS  managers  took 
limited  actions  to  ensure  that  the  field  sites  implemented  the  standard  system 
access  profiles  or  to  otherwise  ensure  that  system  access  controls  within 
CAPS(W)  contributed  to  proper  segregation  of  duties.  DFAS  Orlando  was  the 
only  field  site  to  implement  the  system  access  profiles.  The  other  DFAS  field 
sites  continued  to  develop  unique  system  access  profiles.  Significant 
inconsistencies  existed  in  how  the  field  sites  assigned  the  payment  functions  key 
to  segregating  the  payment  process.  For  example,  while  the  vendor  payment 
operations  in  DFAS  Orlando  and  DFAS  San  Antonio  were  similar  in  size, 

DFAS  San  Antonio  assigned  significantly  more  people  the  ability  to  perform  key 
payment  functions.  The  numbers  of  individuals  assigned  the  key  payment 
functions  at  DFAS  DNO,  DFAS  Lawton,  and  DFAS  Rome  also  differed 
significantly  even  though  they  had  vendor  payment  operations  that  were  similar 
in  size.  As  shown  in  Table  1,  inconsistencies  existed  in  the  assignment  of  the 
key  payment  functions  at  each  of  the  DFAS  field  sites  visited  from  August  2000 
through  March  2001. 
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Table  1.  Inconsistencies  in  Assignment  of  Key  Payment  Functions 

DFAS 
Field  Site 

Number 

of 

Users 

Invoice 

Maintenance 

Receiving 

Report 

Maintenance 

Purchase 

Order 

Maintenance 

Vendor 

Maintenance 

mu 

DNO 

2551 

86 

150 

188 

56 

m 

Lawton 

2192 

85 

127 

105 

93 

42 

Lexington 

56 

35 

35 

35 

16 

32 

6 

Norfolk 

IT 

22 

22 

22 

59 

56 

41 

Orlando 

35 

36 

11 

6 

49 

00 

Rome 

111 

68 

68 

97 

97 

67 

39 

San 

Antonio 

7005 

62 

467 

213 

105 

Seaside 

17 

16 

16 

16 

7 

4 

1.  Includes  64  remote  users  granted  access  to  enter  receiving  reports  and  contracts. 

2.  Includes  139  remote  users  granted  access  to  enter  invoices,  receiving  documents  or  certify  payments. 

3.  Includes  42  remote  users  granted  access  to  8  users  to  enter  invoices,  receiving  reports,  purchase 
order  and  34  with  all  access. 

4.  Includes  23  remote  users  granted  access  to  enter  data  or  certify  payments.  Access  was  removed  prior 
to  site  visit.  Vendor  maintenance  includes  4  remote  users. 

5.  Includes  506  remote  users  granted  access  to  enter  or  certify  data. 

Most  DFAS  field  sites  limited  the  ability  to  enter  invoices  and  receiving 
reports  to  technicians  assigned  to  a  vendor  payment  team.  However,  DFAS 
San  Antonio  provided  254  individuals  at  various  installations  with  the  ability  to 
enter  receiving  reports  into  CAPS(W).  Despite  granting  the  remote  access, 
DFAS  San  Antonio  had  problems  obtaining  receiving  reports  because  the 
individuals  with  the  remote  access  did  not  use  the  access  granted  to  them  to 
enter  the  receiving  report  data.  In  addition,  DFAS  field  sites  provided  between 
2  and  325  individuals  with  the  ability  to  direct  where  payments  could  be  sent. 
DFAS  field  sites  also  had  not  appropriately  limited  the  number  of  users  who 
could  certify  payments.  Three  field  sites  allowed  only  supervisors  or  other 
appointed  officials  access  to  certify  payments  and  limited  access  to  no  more  than 
eight  users.  Other  field  sites  allowed  up  to  105  users  to  certify  payments, 
including  system  management  personnel,  remote  users,  and  data  entry  clerks. 

Changes  to  Initial  System  Access  Profiles.  The  invoice  maintenance 
function,  receiving  report  maintenance  function,  and  purchase  order 
maintenance  function  could  be  combined  into  one  function  provided  that  the 
same  individuals  did  not  also  have  the  ability  to  compute  payments.  DFAS 
Lawton  developed  system  access  profiles  to  separate  who  could  enter  data, 
compute  payments,  and  certify  contract  payments.  However,  similar 
requirements  were  not  implemented  for  segregating  duties  for  making 
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miscellaneous  payments.  A  miscellaneous  payment  function  had  been  designed 
to  provide  users  with  the  ability  to  enter  all  payment  information,  compute  the 
payment,  and  enter,  update,  and  delete  vendor  maintenance  data.  At  a 
minimum,  separate  individuals  should  be  responsible  for  entering  payment 
information,  computing  the  payment,  and  certifying  the  payment.  As  discussed 
in  Inspector  General,  DoD,  Report  No.  D-2002-008,  the  ability  to  delete  data 
should  be  limited  to  only  a  few  supervisory  personnel  who  can  ensure  that  a 
proper  audit  trail  is  maintained. 

System  Access  Profiles  at  Smaller  Field  Sites.  DFAS  managers 
expressed  concerns  that  standard  system  access  profiles  would  not  be  practicable 
at  field  sites  with  smaller  vendor  payment  offices.  They  stated  that  these  sites 
did  not  have  sufficient  personnel  to  segregate  the  ability  to  enter,  compute,  and 
certify  data.  Reviews  of  system  access  at  the  field  sites  (DFAS  Lexington, 
Lexington,  Kentucky;  DFAS  Norfolk;  and  DFAS  Seaside,  Seaside,  California) 
with  smaller  offices  for  making  vendor  payments  using  CAPS(W)  showed  that 
these  offices  probably  did  not  have  sufficient  personnel  to  properly  segregate 
duties  if  the  standard  system  access  profiles  were  implemented.  However,  the 
need  still  existed  to  properly  segregate  payment  functions  to  minimize  the  risk 
that  erroneous  payments  could  be  made  without  detection.  DFAS  managers 
should  assess  vendor  payment  operations  at  field  sites  with  small  vendor 
payment  offices  and  determine  whether  it  would  be  more  cost-effective  to 
increase  the  staffing  levels  at  these  sites  or  move  the  workload  to  a  field  site 
capable  of  properly  segregating  payment  duties. 

Remote  Access  to  CAPS(W) 

Only  three  of  the  eight  DFAS  field  sites  making  payments  using  CAPS(W) 
restricted  access  to  individuals  at  the  field  site.  As  discussed  in  Inspector 
General,  DoD,  Report  No.  D-2002-008,  the  system  functionality  of  CAPS(W) 
did  not  restrict  remote  users  to  only  transactions  related  to  their  organization. 
Consequently,  individuals  granted  the  ability  to  enter  payment  data  or  certify  a 
payment  for  one  site  could  perform  the  same  function  on  other  payments  within 
the  CAPS  database.  DFAS  should  remove  the  ability  to  update  and  certify 
information  in  CAPS(W)  from  all  remote  users  until  the  system  can  provide 
proper  segregation  of  duties  and  security  over  remotely  entered  data. 

Use  of  CAPS  Clipper 


The  Clipper  version  of  CAPS  did  not  have  the  functionality  necessary  to 
properly  segregate  payment  functions.  In  addition,  CAPS  Clipper  allowed 
certain  users  to  alter  payment  data  during  the  computation  process.  Major 
system  changes  were  needed  to  properly  segregate  access  in  CAPS  Clipper. 

Segregation  of  Payment  Functions.  The  payment  functions  in  CAPS  Clipper 
did  not  properly  segregate  duties.  The  level  of  access  individuals  had  to  CAPS 
Clipper  depended  upon  which  of  the  payment  functions  they  were  assigned. 
The  following  six  payment  functions  existed  in  CAPS  Clipper. 
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•  Enter  Invoice  and  Receipt.  This  function  allows  the  user  to  enter 
all  invoice  and  receiving  report  information. 

•  Enter  Purchase  Order.  This  function  allows  the  user  to  enter 
purchase  order  data  and  vendor  remittance  information. 

•  Enter  Modification.  This  function  allows  the  user  to  amend 
purchase  order  data,  EFT  information,  and  vendor  remittance  data. 

•  Compute.  This  function  allows  the  user  to  compute  the  payment 
amount  and  due  date.  A  user  with  this  access  can  also  change  any  of 
the  payment  information  entered,  including  the  invoice  receipt  dates, 
EFT  information,  vendor  remittance  data,  and  payment  terms. 

•  Delete.  This  function  allows  the  user  to  delete  data  previously 
entered  in  the  system. 

•  Interface.  This  function  allows  the  user  to  upload  payments  from 
CAPS  Clipper  to  the  disbursing  system. 

At  a  minimum,  the  following  system  changes  were  required  to  properly 
segregate  payment  functions. 

•  Separate  the  ability  of  entering  EFT  information  and  vendor 
remittance  data  from  all  other  entry  and  computation  functions. 

•  Remove  the  ability  to  alter  payment  information  from  the  compute 
function. 

Conclusion.  DFAS  must  assess  the  practicality  of  maintaining  CAPS  Clipper. 
Even  though  the  fielding  of  DPPS  has  slipped,  we  recognize  that  making  needed 
system  changes  may  no  longer  be  practical  or  cost-effective.  If  system  access 
controls  can  not  be  improved  in  a  cost-effective  manner,  DFAS  should  develop 
plans  to  move  the  vendor  payment  workload  to  another  system  that  will  allow 
duties  to  be  properly  segregated.  DFAS  should  also  determine  whether 
sufficient  personnel  are  available  at  each  site  that  makes  vendor  payments  using 
CAPS  Clipper  and  consolidate  vendor  payment  operations  as  needed. 

Other  System  Deficiencies  Within  CAPS 


Deficiencies  existed  within  CAPS  for  controlling  user  passwords,  monitoring 
system  inactivity,  and  securing  upload  files  transferred  between  CAPS  and 
disbursing  systems.  Although  these  problems  had  been  recognized  by  DFAS 
managers  and  identified  in  the  Annual  Statements  of  Assurance  prepared  by 
DFAS  field  sites  since  1998,  funding  for  needed  system  changes  had  not  been 
approved  because  DPPS  was  to  be  fielded  in  FY  2001.  However,  because  plans 
to  replace  CAPS  with  DPPS  have  slipped  from  FY  2001  to  an  undetermined 
date,  known  system  deficiencies  require  immediate  correction. 

Password  Controls.  Password  controls  in  CAPS(W)  and  CAPS  Clipper  did  not 
adequately  protect  the  vendor  payment  databases  used  to  store  vendor  payment 
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information  and  make  vendor  payments.  CAPS  did  not  limit  the  number  of 
attempts  an  individual  user  could  make  at  entering  a  password.  According  to 
the  National  Computer  Security  Center  Standard  002-85,  “DoD  Password 
Management  Guide,”  April  1,  1985,  controls  should  be  established  on  the 
number  of  guesses  an  individual  user  identification  may  attempt  before  the 
system  prevents  access.  Individuals  could  also  sign  on  at  multiple  locations 
using  the  same  user  identification  and  password.  This  allows  for  the  sharing  of 
passwords  and  circumvention  of  system  access  controls.  Further,  system 
administrators  could  view  the  system-generated  passwords.  The  system 
administrator  generated  the  user  identification  and  passwords  and  provided  the 
individual  users  with  their  passwords.  Since  the  system  administrators  can  view 
the  passwords,  the  passwords  were  exposed  to  individuals  other  than  the  user 
and  were  subject  to  compromise.  As  a  result  of  these  deficiencies  in  password 
controls,  information  in  CAPS  was  highly  susceptible  to  unauthorized  use  and 
manipulation. 

DFAS  field  sites  did  not  ensure  that  CAPS  required  an  immediate  password 
change  upon  initial  entry  to  the  system  using  a  default  password.  The  DoD 
Password  Management  Guide  recommends  that  default  passwords  be  changed 
immediately.  The  system  should  identify  the  user  identification  as  having  an 
expired  password  and  require  the  user  to  change  the  default  password  before 
receiving  authorization  to  access  the  system.  This  process  ensures  that  the 
individual  assigned  the  user  identification  is  the  only  person  who  knows  the 
password.  At  DFAS  San  Antonio,  we  were  able  to  gain  access  to  the  system 
using  the  default  password.  We  determined  that  some  potential  users  had  never 
accessed  the  system.  Consequently,  they  never  changed  the  default  password. 
System  managers  should  ensure  that  the  default  password  is  set  to  expire  soon 
after  being  issued. 

Monitoring  System  Activity.  Neither  version  of  CAPS  could  provide  an  audit 
trail  to  track  system  activity  or  disable  user  identifications  for  non-use  of  the 
system.  Auditing  logs  should  capture  user  actions.  The  National  Computer 
Security  Center  Technical  Guide  028,  “Assessing  Controlled  Access 
Protection,”  May  25,  1992,  recommends  that  a  system  be  able  to  record  system 
activity  for  each  user  identification.  Auditing  logs  assist  managers  in 
determining  that  only  authorized  and  valid  users  have  access  to  the  system.  The 
system  should  also  be  capable  of  disabling  a  user  identification  that  is  not  used 
within  a  specific  timeframe.  Disabling  user  identifications  ensures  the  removal 
of  users  who  do  not  frequently  access  the  system.  DFAS  should  change  CAPS 
so  that  it  can  monitor  system  activity  and  remove  access  from  individuals  who 
do  not  access  CAPS  for  more  than  45  days. 

Encrypting  System  Uploads.  The  upload  files  that  are  sent  from  CAPS  to  the 
disbursement  systems  were  not  secure.  The  database  files  were  not  encrypted 
and  could  have  been  manipulated  and  changed.  DFAS  needs  to  encrypt  the  data 
files  transferred  between  CAPS  and  the  disbursement  systems  to  ensure  the 
integrity  of  certified  payments. 
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System  Interfaces 


Operational  interfaces  between  CAPS  and  SPS  and  the  CEFT  database  were  not 
functioning  properly  or  did  not  exist.  DFAS  field  sites  had  to  manually  enter 
the  payment  data  needed  to  populate  the  purchase  order  and  vendor  remittance 
fields  in  CAPS.  Entering  data  twice  increases  the  risk  of  data  input  errors  and 
erroneous  payments. 

Standard  Procurement  System.  Contract  data  were  not  electronically 
interfaced  between  CAPS  and  SPS.  During  FY  2001,  technicians  had  to 
manually  enter  the  information  from  at  least  66  percent  of  all  contracts  entered 
into  CAPS  before  a  payment  was  made.  DFAS  reported  that  delays  in  entering 
contract  data  into  CAPS  resulted  in  the  payment  of  interest  penalties  of 
$1 .2  million  in  FY  2000  and  $1 .9  million  in  the  first  10  months  of  FY  2001 . 
DFAS  and  the  Army  have  been  working  to  resolve  this  issue  but  significant 
progress  has  not  been  made.  Problems  include  the  lack  of  standard  system  edits 
between  the  systems  and  inconsistencies  in  DoD  regulations  concerning  required 
payment  information.  The  Directors  of  several  DFAS  field  sites  told  us  that  the 
inability  to  interface  data  between  the  systems  caused  significant  backlogs  in  the 
entry  of  contract  data  and  delays  in  making  payments  to  vendors.  Problems 
entering  contract  data  were  especially  acute  at  the  beginning  of  each  fiscal  year. 
Based  on  the  implementation  plan  for  DPPS,  contract  data  from  SPS  will 
interface  with  DPPS.  Until  DPPS  is  fielded,  DFAS  and  Army  managers  should 
work  together  to  overcome  obstacles  that  prevent  the  automated  interface  of 
contract  data  between  SPS  and  CAPS. 

CEFT  Database.  Neither  version  of  CAPS  had  an  electronic  interface 
with  the  CEFT  database.  As  a  result,  DFAS  field  sites  granted  access  to  most 
vendor  payment  technicians  to  manually  enter  EFT  information  and  vendor 
remittance  data  into  CAPS.  An  automated  interface  with  the  CEFT  would 
ensure  that  proper  remittance  information  is  entered  into  CAPS,  limit  the 
number  of  times  the  data  needed  to  be  entered,  and  reduce  problems  segregating 
duties  at  DFAS  field  sites.  DFAS  should  develop  an  action  plan  for  interfacing 
the  data  contained  in  the  CEFT  with  the  CAPS  vendor  maintenance  tables. 

Summary 


Access  to  CAPS(W)  and  CAPS  Clipper  was  not  adequately  controlled  and 
monitored.  DFAS  field  sites  making  payments  for  the  Army  and  Defense 
agencies  did  not  limit  the  number  of  users  who  could  update  the  vendor 
maintenance  tables,  enter  miscellaneous  payments,  and  delete  information  in 
CAPS.  Standard  user  profiles  for  CAPS  should  be  developed  that  fully  consider 
the  need  to  standardize  the  structure  of  the  vendor  payment  office  and  business 
practices  within  DFAS  for  making  vendor  payments.  Remote  access  should  be 
removed  until  proper  system  controls  can  be  implemented.  Password  controls 
need  to  be  improved  and  system  controls  need  to  be  updated.  Plans  for 
overcoming  problems  that  have  prevented  automated  interfaces  between  CAPS 
and  SPS  and  the  CEFT  database  also  need  to  be  developed  and  implemented. 
System  activity  also  needs  to  be  adequately  monitored  and  controlled.  Certified 
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data  sent  to  the  disbursement  system  must  not  be  subjected  to  potential 
compromise  or  alteration.  Although  some  of  these  problems  were  recognized 
by  DFAS  managers  and  identified  in  the  Annual  Statements  of  Assurance 
prepared  by  DFAS  field  sites,  corrective  actions  were  not  taken  in  anticipation 
of  die  fielding  of  DPPS.  However,  since  DPPS  will  not  replace  CAPS  as  soon 
as  originally  planned,  known  system  deficiencies  require  immediate  correction. 
Until  proper  corrective  actions  can  be  implemented  or  CAPS  is  replaced  by 
DPPS,  the  access  and  control  deficiencies  with  both  versions  of  CAPS  should  be 
reported  as  a  material  control  weakness  in  the  DFAS  Annual  Statement  of 
Assurance. 

Recommendations,  Management  Comments,  and  Audit 
Response 


B.  We  recommend  that  the  Director,  Commercial  Pay  Services: 

1.  Develop  and  implement  standard  system  access  profiles  to 
complement  a  standard  business  structure  for  making  payments  using  the 
Computerized  Accounts  Payable  System. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  standard  system  access  profiles  for  making  payments  using  CAPS 
were  being  evaluated.  Implementation  of  standard  system  profiles  with  the 
appropriate  realignment  of  organizational  elements  will  take  place  in  June  2002. 

2.  Evaluate  the  ability  of  smaller  vendor  payment  offices  to  use 
standard  system  profiles.  As  necessary,  increase  the  staffing  needed  to 
adequately  segregate  duties  or  relocate  vendor  payment  operations  to  a  field 
site  that  can  properly  segregate  duties. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially 
concurred  and  stated  that  a  review  was  being  conducted  to  determine  the  ability 
of  smaller  vendor  payment  offices  to  use  standard  system  profiles  and  maintain 
proper  segregation  of  duties. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  If  smaller 
vendor  payment  offices  cannot  implement  the  standard  system  profiles,  DFAS 
must  take  appropriate  actions  to  properly  segregate  payment  functions  or  move 
the  workload  to  a  field  site  capable  of  implementing  the  standard  system 
profiles.  We  request  that  DFAS  provide  additional  comments  to  the  final 
report. 


3.  Remove  remote  access  to  update  and  certify  information  in  the 
Computerized  Accounts  Payable  System  for  Windows  until  the  system  can 
provide  proper  segregation  of  duties  and  security  over  remotely  entered 
data. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially 
concurred  and  stated  that  remote  certification  access  was  removed  at  all  Army 
Vendor  Payment  Support  sites.  The  Director  also  stated  that  two  remote  access 
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profiles  were  being  developed.  One  profile  will  allow  users  to  input  contracts, 
modifications,  invoices,  and  receiving  report  information.  The  other  profile 
will  allow  remote  users  to  compute  payments. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  Creation  of 
the  two  new  profiles  will  not  alleviate  many  of  the  issues  concerning  remote 
access.  Before  remote  access  can  be  considered,  CAPS(W)  must  be  modified  to 
restrict  remote  users  to  only  information  related  to  their  organization  and  system 
controls  must  be  developed  to  ensure  that  information  entered  by  remote  users  is 
not  altered  after  entry.  In  addition,  controls  must  be  adequate  to  provide 
certifying  officials  with  reasonable  assurance  that  the  information  entered  by 
remote  users  is  accurate  and  supported.  We  request  that  DFAS  reconsider  its 
position  and  provide  additional  comments  to  the  final  report. 

4.  Develop  a  plan  of  action  to  have  field  sites  using  the  Clipper 
version  of  the  Computerized  Accounts  Payable  System  use  another  vendor 
payment  system  unless  system  access  controls  can  be  improved  and  other 
system  deficiencies  corrected  in  a  cost-effective  manner. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially 
concurred  and  stated  that  improvements  to  the  Clipper  version  of  the  CAPS 
were  determined  to  be  cost-effective.  Improvements  to  system  access  controls 
will  be  fielded  in  July  2002  with  the  release  of  CAPS  Clipper  version  7.0. 

5.  Develop  and  fund  system  change  requests  to  correct  password 
and  system  control  deficiencies  in  the  Computerized  Accounts  Payable 
System  for  Windows. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  system  change  requests  have  been  developed  to  correct  password  and 
system  control  deficiencies.  The  changes  will  be  included  in  the  CAPS  version 
7.0  release. 

6.  Develop  action  plans  for  overcoming  obstacles  that  prevent  the 
automated  interfacing  of  data  between  the  Computerized  Accounts  Payable 
System  and  the  Standard  Procurement  System  and  for  implementing 
automated  interfaces  between  the  Computerized  Accounts  Payable  System 
and  the  Corporate  Electronic  Funds  Transfer  database. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  a  Memorandum  of  Agreement  between  DFAS  and  the  Army 
addressing  the  interface  between  SPS  and  CAPS  was  signed  on  November  26, 
2001.  System  change  requests  have  been  written  to  refine  the  SPS  files  so  that 
CAPS  can  receive  them  without  manual  intervention.  The  Director  also  stated 
that  CAPS  is  scheduled  to  interface  with  the  CEFT  database  in  the  6.0  release 
scheduled  for  November  2002. 

7.  Report  access  and  control  deficiencies  with  the  Computerized 
Accounts  Payable  System  as  a  material  control  weakness  in  the  Annual 
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Statement  of  Assurance  for  the  Defense  Finance  and  Accounting  Service 
until  proper  corrective  actions  can  be  implemented  or  the  system  is  replaced 
by  the  Defense  Procurement  Payment  System. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  two  material  control  weaknesses  related  to  access  and  control 
deficiencies  with  CAPS  were  reported  in  the  DFAS  Columbus  FY  2001  Annual 
Statement  of  Assurance  for  Vendor  Pay  Services. 


27 


C.  Document  Requirements  for  Making 
Vendor  Payments 

DFAS  field  sites  frequently  made  erroneous  payments  and  other 
payments  that  were  not  fully  supported  by  proper  documents.  We 
estimate  that  181,406  of  the  236,940  vendor  payments  made  by  DFAS 
field  sites  for  the  Army  and  Defense  agencies  from  May  1  through 
July  31,  2000,  lacked  at  least  one  element  of  support  required  by 
5  C.F.R.  Part  1315.  We  also  estimate  that  30,584  payments  were  in  the 
wrong  amounts.  Erroneous  payments  and  improperly  supported 
payments  were  made  because: 

•  DoD  Regulation  7000. 14-R,  volume  10,  allowed  exceptions  to 
requirements  for  a  proper  invoice  and  did  not  specify  what  a 
receiving  report  must  contain  to  properly  support  a  payment; 

•  technicians  incorrectly  entered  payment  data  and  miscomputed 
payment  vouchers  in  CAPS; 

•  receiving  activities  provided  inaccurate  data  on  the  receipt  and 
acceptance  of  goods  and  services; 

•  standardized  business  rules  did  not  exist  for  properly  supporting 
all  types  of  miscellaneous  payments;  and 

•  technicians  and  certification  officials  either  did  not  detect  missing 
and  incomplete  items  on  supporting  documents  or  considered  the 
items  unnecessary  for  making  the  payments. 

As  a  result,  DoD  managers  assumed  an  increased  risk  that  payments 
were  not  being  made  in  compliance  with  the  PPA.  In  addition,  resources 
were  diverted  from  their  intended  use  due  to  efforts  to  correct  duplicate 
payments  and  other  erroneous  payments. 

Supporting  Vendor  Payments 

Criteria.  5  C.F.R.  Part  1315  identifies  strict  requirements  that  supporting 
documents  must  meet  in  order  to  be  proper  for  payment.  The  requirements  for 
supporting  documentation  are  further  defined  in  FAR  subpart  32.9,  DFARS 
subpart  232.9,  and  DoD  Regulation  7000. 14-R,  volume  10.  DFAS  field  sites 
made  payments  based  on  contractual  documents  that  needed  to  comply  with 
5  C.F.R.  Part  1315  requirements.  Miscellaneous  payments  to  businesses  and 
individuals  had  limited  business  rules  on  how  each  payment  should  be 
supported.  DoD  Regulation  7000. 14-R,  volume  10,  and  DFAS  Indianapolis 
Regulation  37-1,  chapter  9,  January  2000,  contain  some  guidance  on  how  to 
support  miscellaneous  payments.  Guidance  on  supporting  documentation  is 
discussed  in  Appendix  D.  Erroneous  payments  are  a  significant  problem 
receiving  increased  attention  by  the  Congress  and  GAO.  Payments  made  for 
incorrect  amounts  are  considered  erroneous  payments. 
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Sample  Selection.  To  determine  whether  vendor  payments  made  using  CAPS 
were  properly  supported,  we  obtained  a  population  of  236,940  CAPS  payments, 
valued  at  about  $4.1  billion,  made  from  May  1  through  July  31,  2000.  From 
this  population,  we  selected  a  sample  of  300  payments  in  3  strata.  We  used  the 
criteria  in  5  C.F.R.  Part  1315  to  assess  the  documents  (invoice,  receiving 
report,  and  obligation  document)  that  supported  each  sample  item.  The  sample 
was  also  used  to  determine  whether  the  data  on  the  supporting  documents  were 
entered  correctly  in  CAPS.  Details  concerning  sample  methodology  are 
contained  in  Appendix  E. 

Sample  Results 


The  sample  estimated  that  181,406  payments  made  from  May  1  through  July  31, 
2000,  were  not  properly  supported  as  required  by  5  C.F.R.  Part  1315.  Table  2 
shows  the  projections  of  the  estimated  number  of  payments  that  were  not 
properly  supported  for  each  type  of  payment.  Appendix  E  gives  details  of 
projections  and  confidence  levels. 


Table  2.  Estimated  Payments  Not  Properly 

Supported  by  Type  of  Payment 

Type  of 

Sample 

Total  Payments 

Estimate  of  Improperly 

Payment 

Size 

Supported  Payments* 

Contractual 

148 

105,913 

80,620 

Miscellaneous 

152 

131,027 

100,787 

Total 

300 

236,940 

181,406 

*The  estimates  of  improperly  supported  payments  do  not  total  because  of  rounding. 

To  be  considered  proper,  documents  supporting  contract  payments  must  meet 
the  requirements  in  5  C.F.R.  Part  1315.  We  also  held  supporting 
documentation  for  miscellaneous  payments  to  similar  standards.  The  items 
required  for  properly  supported  payments  are  contained  in  Appendix  D.  Our 
sample  also  identified  39  erroneous  payments  that  were  paid  in  the  incorrect 
amount  to  vendors  and  other  authorized  individuals.  When  projected  over  the 
entire  population,  30,584  payments  were  erroneous.  Appendix  E  gives  details 
of  the  sample  projections.  We  also  questioned  the  appropriateness  of  an 
additional  31  payments  based  on  available  information. 

These  results  were  consistent  with  previously  reported  findings  in  Inspector 
General,  DoD,  Report  No.  D-2000-139,  and  Report  No.  D-2002-008.  It 
showed  that  DFAS  management  did  not  strictly  enforce  the  requirements  for 
proper  supporting  documents,  creating  an  environment  where  erroneous 
payments  can  be  made  without  detection.  It  demonstrates  the  need  for  DFAS 
and  DoD  acquisition  and  financial  managers  to  work  together  to  strictly  enforce 
the  requirements  in  5  C.F.R.  Part  1315.  Further,  FAR  subpart  32.9  was  not 
updated  until  December  18,  2001.  DFARS  subpart  232.9  and  DoD 
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Regulation  7000. 14-R,  volume  10,  still  have  not  been  updated  with  the 
requirements  in  5  C.F.R.  Part  1315.  Guidance  needs  to  be  changed  to  ensure 
proper  payments  are  made. 

Contractual  Payments 


Determination  of  Proper  Payments.  The  sample  results  estimated  that  from 
May  1  through  July  31,  2000,  DFAS  field  sites  made  approximately 
80,620  contract  payments  for  Army  and  Defense  agency  customers  without  the 
proper  support.  DFAS  technicians  and  certification  officials  either  did  not 
detect  missing  items  required  on  supporting  documents  or  considered  the  items 
unnecessary  for  making  the  payments.  Documents  that  lacked  the  required 
elements  of  support  should  have  been  returned  to  the  originator  and  no  payment 
made  until  a  corrected  copy  of  the  document  was  obtained.  Table  E-2 
(Appendix  E)  shows  the  estimated  number  of  unsupported  payments  caused  by 
each  type  of  supporting  document. 2  Because  more  than  one  document  could 
have  caused  a  payment  to  be  improperly  supported,  the  total  number  of 
improperly  supported  payments  in  Table  E-2  exceeds  80,620  payments. 

Invoices.  The  review  of  sample  contractual  payments  showed  that 
38  invoices  did  not  properly  support  the  payments.  (More  than  one  invoice 
supported  some  payments.)  Invoices  were  considered  improper  if  they  did  not 
contain  a  valid  contract  number,  did  not  adequately  describe  what  was 
purchased  or  the  description  was  inconsistent  with  the  contract,  or  were  altered. 
Our  sample  showed  the  following. 

•  DFAS  field  sites  made  29  payments  using  vendor  invoices  that  did 
not  have  a  contract  number. 

•  Items  billed  on  invoices  related  to  22  contracts  were  not  consistent 
with  the  contract  line  items  or  did  not  contain  an  adequate  description 
of  the  items  being  invoiced. 

•  Invoices  related  to  10  contracts  were  altered  to  make  the  invoices 
proper  for  payment.  All  of  the  altered  invoices  were  corrected  by 
someone  other  than  the  vendor  and  did  not  clearly  state  that  the 
invoice  was  a  corrected  copy. 

When  the  results  were  projected  over  the  entire  population,  32,437  vendor 
invoices  were  not  proper  for  payment  and  should  have  been  returned  to  the 
vendor  for  correction.  Appendix  E  gives  details  of  the  sample  projections. 
DFAS  technicians  accepted  the  invoices  even  though  the  required  information 
was  missing  or  incomplete  because  DoD  Regulation  7000. 14-R,  volume  10, 
allowed  exceptions  to  the  requirements  for  a  proper  invoice.  However, 

5  C.F.R.  Part  1315  required  the  return  of  any  improper  invoice  to  the  vendor 
within  7  days  of  receipt.  The  FAR  and  DoD  Regulation  7000. 14-R,  volume  10, 
had  not  been  updated  with  the  more  stringent  requirements  for  invoices  that  had 


2More  than  one  invoice  and  receiving  report  could  have  supported  a  payment.  For  sampling  purposes, 
we  considered  each  payment  to  have  only  one  invoice  and  receiving  report. 
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been  added  to  5  C.F.R.  Part  1315  in  September  1999  (Appendix  D).  Inspector 
General,  DoD,  Report  No.  D-2000-139,  addressed  the  need  for  the  Under 
Secretary  of  Defense  (Comptroller)  to  change  DoD  Regulation  7000. 14-R, 
volume  10.  As  of  the  date  of  this  report,  the  regulation  had  not  been  changed. 

Receiving  Reports.  The  review  of  sample  contractual  payments  showed 
that  102  did  not  have  properly  supported  receiving  reports.  (Some  payments  had 
more  than  one  receiving  report.)  Receiving  reports  were  considered  improper 
if  they  did  not  contain  a  valid  contract  or  obligation  number;  did  not  contain  a 
proper  receipt  and  acceptance  date;  did  not  adequately  describe  the  goods 
received  or  services  performed  or  the  description  was  inconsistent  with  the 
contract;  or  did  not  contain  proper  signature  information  for  the  receiving  or 
accepting  official.  Our  sample  showed  the  following. 

•  DFAS  field  sites  made  23  payments  using  receiving  reports  that  did 
not  identify  a  valid  contract  number. 

•  Receiving  reports  related  to  49  payments  did  not  show  the  dates 
receipt  and  acceptance  occurred. 

•  Items  on  receiving  reports  related  to  54  contracts  were  not  consistent 
with  the  contract  line  items  or  did  not  contain  an  adequate  description 
of  the  goods  and  services  received. 

•  Required  signature  information  was  not  on  receiving  reports  related 
to  76  contracts. 

When  our  results  were  projected  over  the  population,  74,000  receiving  reports 
did  not  meet  the  requirements  of  a  proper  receiving  report  and  should  have  been 
returned  to  the  receiving  activity  for  correction.  Appendix  E  contains  details  on 
sample  projections.  Most  of  the  forms  that  were  used  as  receiving  reports  that 
we  found  to  be  improper  were  not  designed  to  be  receiving  reports.  In  response 
to  Inspector  General,  DoD,  Report  No.  D-2002-008,  the  Director,  Defense 
Procurement,  will  require  DD  Form  250,  “Material  Inspection  and  Receiving 
Report,”  be  used  as  the  primary  means  for  documenting  receipt  and  acceptance 
of  goods  and  services.  The  use  of  DD  Form  250  should  significantly  improve 
compliance  with  the  requirements  in  5  C.F.R.  Part  1315. 

Contracts.  The  review  of  sample  items  showed  that  13  contracts  did 
not  provide  proper  payment  support.  Twelve  contracts  did  not  contain  sufficient 
information  for  the  payment  office  to  properly  match  invoice  and  receipt 
information  and  make  the  payment  to  the  correct  vendor.  In  one  instance,  the 
payment  office  could  not  locate  the  contract  and  the  contract  was  not  in  the 
EDA  system. 

Specific  Problems  Related  to  Documents  Supporting  Contractual  Payments. 

At  DFAS  field  sites  making  vendor  payments  using  CAPS  for  the  Army  and 
Defense  agencies,  we  identified  the  same  types  of  problems  with  the  invoices, 
receiving  reports,  and  contracts  that  we  identified  at  DFAS  Kansas  City.  We 
identified  those  problems  in  Inspector  General,  DoD,  Report  No.  D-2002-008. 
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We  also  identified  several  additional  problems  with  making  vendor  payments  for 
the  Army  and  Defense  agencies  that  warrant  the  attention  of  DFAS  and  Army 
acquisition  and  financial  managers. 

Invoices  Sent  to  Designated  Billing  Offices.  The  sample  showed  that 
invoices  supporting  28  contractual  payments  did  not  identify  that  the  designated 
billing  office  affixed  the  invoice  receipt  date  to  the  invoice.  In  these  cases,  it 
was  not  easy  to  determine  whether  the  affixed  date  stamp  belonged  to  the  billing 
office  designated  in  the  contract  or  to  some  other  activity.  DFAS  field  sites  did 
not  verify  who  affixed  the  date  stamp  on  the  invoice.  They  assumed  that  the 
date  reflected  the  date  the  invoice  was  received  in  the  designated  billing  office. 
Instead,  the  date  of  the  invoice  should  have  been  used  to  determine  the  payment 
due  date.  During  FY  2001,  DFAS  Indianapolis  issued  three  policy  messages 
that  reiterated  the  requirements  that  a  date  stamp  identify  the  designated  billing 
office.  DFAS  field  sites  should  use  the  invoice  date  in  calculating  the  payment 
due  date  if  the  date  stamp  does  not  clearly  identify  the  designated  billing  office. 
DFAS  field  sites  should  identify  designated  billing  offices  that  do  not  clearly 
demonstrate  that  they  affixed  the  invoice  receipt  dates  to  invoices  and  work  with 
the  Army  to  provide  training  on  the  importance  of  affixing  identifiable  date 
stamps  on  invoices  provided  to  the  payment  offices. 

Validity  of  Receipt  and  Acceptance  Dates.  Receiving  activities 
provided  DFAS  field  sites  with  receipt  and  acceptance  dates  on  receiving  reports 
that  did  not  reflect  the  actual  dates  the  goods  or  services  were  received  and 
accepted.  We  contacted  receiving  activities  and  analyzed  the  data  provided  on 
invoices  and  contracts  and  determined  that  64  contractual  payments  were  made 
based  on  receipt  and  acceptance  dates  that  did  not  reflect  the  actual  dates  the 
activity  should  have  received  the  items  invoiced.  DFAS  field  sites  rarely 
questioned  the  validity  of  die  receipt  and  acceptance  dates  provided  by  receiving 
activities.  The  date  on  the  receiving  report  usually  represented  the  date  an 
official  completed  the  receiving  report,  not  the  actual  date  that  the  goods  or 
services  were  received  and  accepted.  For  example: 

•  Invoice  number  000-013  was  received  at  DFAS  Rock  Island  for 
support  services  performed  from  March  12  through  25,  2000.  A 
Government  official  signed  the  receiving  report  on  April  17,  2000, 
and  the  payment  was  made  on  May  15,  2000.  We  called  the  receiver 
and  determined  that  the  date  reflected  the  date  that  the  receiver 
certified  the  invoice  for  payment,  not  the  date  the  services  were 
received  and  accepted.  The  receiver  stated  that  at  the  time  this 
receiving  report  was  filled  out  she  was  not  aware  that  the  actual  dates 
for  receipt  and  acceptance  were  needed.  If  the  payment  was  based 
on  the  actual  constructive  acceptance  date  of  April  1,  2000,  the 
vendor  would  have  been  entitled  to  approximately  $2,800  in  interest. 

•  DFAS  Lexington  made  a  payment  on  July  27,  2000,  based  on  a 
receipt  and  acceptance  date  of  June  16,  2000.  However,  a 
spreadsheet  attached  to  the  receiving  report  showed  the  actual  receipt 
date  was  May  31,  2000.  Had  the  payment  due  date  been  computed 
based  on  the  actual  receipt  date,  this  vendor  was  due  $600  in  interest 
penalties  that  were  not  paid. 
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When  projected  over  the  entire  population,  37,949  payments  were  made  using 
receiving  reports  with  dates  that  did  not  reflect  the  actual  dates  of  receipt  and 
acceptance.  Appendix  E  contains  details  on  sample  projections.  The  use  of  later 
dates  for  computing  payment  due  dates  often  resulted  in  payments  being  made 
later  than  they  should  have  been  and  in  amounts  that  deprived  vendors  of 
required  interest  penalties.  Some  receivers  informed  us  that  they  were  unaware 
of  the  requirement  to  provide  proper  dates  for  receipt  and  acceptance  of  goods 
and  services  on  receiving  reports.  Army  managers  need  to  train  all  individuals 
authorized  to  receive  goods  and  services  on  the  need  to  record  the  actual  dates 
the  activity  received  and  accepted  the  goods  and  services  on  the  receiving 
reports.  Further,  DFAS  technicians  should  assess  whether  the  dates  provided 
on  receiving  reports  are  reasonable  based  on  the  information  on  the  invoices  and 
contracts  and  the  documents  accompanying  receiving  reports.  In  situations 
where  the  dates  do  not  seem  reasonable,  the  technician  should  contact  the 
receiver  and  verify  that  the  receiving  report  identifies  the  actual  receipt  and 
acceptance  dates. 

Delivery  Order  Contract  Paid  at  Multiple  Field  Sites.  DFAS  Lawton, 
DFAS  Rock  Island,  and  DFAS  St.  Louis  made  payments  on  contract  number 
DABT60-97-D-0007.  The  sample  payment  reviewed  at  DFAS  St.  Louis  showed 
that  the  invoice  and  receiving  report  did  not  properly  support  the  payment 
because  they  were  inconsistent  with  the  line  items  on  the  contract.  The  basic 
delivery  order  contract  identified  DFAS  Lawton  as  the  payment  office  but  the 
contracting  office  issued  delivery  orders  to  two  other  DFAS  field  sites.  Further 
research  showed  that  delivery  order  number  0139  was  paid  by  both  DFAS 
Lawton  and  DFAS  Rock  Island,  and  the  vendor  used  the  same  invoice  to  bill 
both  DFAS  field  sites.  We  did  not  perform  enough  work  to  identify  any 
duplicate  payments;  however,  allowing  multiple  payment  offices  to  make 
payments  on  the  same  contract  increases  the  potential  for  duplicate  payments. 
The  built-in  system  edit  checks  in  CAPS  and  the  use  of  the  Predator  application 
will  not  detect  and  prevent  duplicate  payments  from  being  made  by  multiple 
DFAS  field  sites.  Army  contracting  needs  to  eliminate  the  practice  of  creating 
contracts  with  more  than  one  payment  office,  and  DFAS  and  Army  fund 
managers  should  conduct  an  audit  of  the  contract  number  DABT60-97-D-0007 
to  determine  whether  duplicate  or  erroneous  payments  have  been  made. 

Support  for  Miscellaneous  Payments 


Inspector  General,  DoD,  Report  No.  D-2000-139,  recommended  that  the  Under 
Secretary  of  Defense  (Comptroller)  amend  DoD  Regulation  7000. 14-R, 
volume  10,  to  standardize  the  business  rules  for  making  properly  supported 
miscellaneous  payments.  As  of  the  date  of  this  report,  the  guidance  for  making 
vendor  payments  in  DoD  Regulation  7000. 14-R,  volume  10,  had  not  been 
changed.  The  guidance  in  DFAS  Indianapolis  Regulation  37-1  also  did  not 
identify  what  information  is  required  to  properly  support  each  type  of 
miscellaneous  payment.  At  a  minimum,  the  payment  office  should  require  that; 

•  a  proper  authorization  document  exists  that  supports  the  vendor’s  or 
claimant’s  claim  against  the  Government; 

•  a  request  exists  for  payment  by  the  claimant  or  vendor;  and 
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•  an  employee  at  the  receiving  activity  acknowledges  that  the  claim, 
item,  or  service  was  received  and  accepted. 

Although  DFAS  field  sites  tried  to  follow  guidance  for  making  miscellaneous 
payments,  procedures  were  inconsistently  followed  and  improperly  supported 
payments  were  made.  The  use  of  Standard  Form  1034,  “Public  Voucher  for 
Purchases  and  Services  Other  than  Personal,”  for  other  than  its  intended 
purpose  was  associated  with  many  of  the  improperly  supported  miscellaneous 
payments. 

Requirements  for  Proper  Support.  Invoices,  receiving  reports,  and  obligation 
documents  supporting  miscellaneous  payments  were  frequently  not  proper.  The 
sample  showed  that  100,787  payments  were  made  from  May  1  through  July  31, 
2000,  without  sufficient  support  (see  Appendix  E).  Table  E-3  shows  the 
estimated  number  of  unsupported  payments  caused  by  each  type  of  supporting 
document.  Because  more  than  one  document  could  have  caused  a  payment  to  be 
improperly  supported,  the  total  number  of  improperly  supported  payments  in 
Table  E-3  exceeds  100,787  payments. 

Although  problems  existed  with  some  of  the  invoices  and  obligation  documents 
supporting  miscellaneous  payments,  all  of  the  improperly  supported  payments 
had  an  improper  receiving  report.  The  receiving  reports  did  not  contain  enough 
information  to  ensure  that  the  receiving  reports  were  proper  or  that  the  claim, 
goods,  or  services  were  actually  received  and  accepted  by  an  authorized 
Government  official.  Inspector  General,  DoD,  Report  No.  D-2002-008, 
recommended  that  the  Director,  Commercial  Pay  Services,  develop  interim 
procedures  for  making  properly  supported  miscellaneous  payments  that  can  be 
used  by  the  DFAS  field  sites  until  DoD  Regulation  7000. 14-R,  volume  10,  is 
changed.  As  of  September  7,  2001,  the  Director,  Commercial  Pay  Services, 
had  not  issued  interim  procedures  for  making  properly  supported  miscellaneous 
payments. 

Use  of  the  Standard  Form  1034.  Payment  offices  improperly  made 
miscellaneous  payments  based  on  information  found  on  SF  1034s.  The  SF  1034 
is  a  payment  voucher  that  should  be  used  to  provide  the  payment  office  with  the 
authority  to  make  a  payment,  which  is  certified  and  signed  by  an  authorized 
certifying  official  appointed  as  specified  in  DoD  7000. 14-R,  volume  5. 
Supporting  documents  are  either  attached  to  the  form  or  retained  at  the  office 
preparing  the  SF  1034.  Technicians  at  the  DFAS  field  sites  are  only  required  to 
enter  the  information  from  the  SF  1034  into  CAPS.  For  18  miscellaneous 
payments  in  our  sample,  an  SF  1034  was  inappropriately  used  as  the  receiving 
report  and  obligation  document.  Sometimes  the  voucher  number  on  the 
SF  1034  was  used  as  the  invoice  number  instead  of  the  actual  invoice  number 
from  the  vendor  invoice.  This  practice  made  it  difficult  for  vendors  to  identify 
what  invoices  were  being  paid  and  increased  the  risk  that  a  duplicate  payment 
could  occur.  For  15  other  sample  items,  an  SF  1034  was  signed  by  an 
authorized  certifying  official;  however,  the  SF  1034s  often  did  not  contain  all 
the  information  needed  to  support  a  payment,  including  an  invoice  date,  invoice 
number,  receipt  and  acceptance  dates,  and  contract  number.  In  those  instances, 
the  technicians  had  to  use  other  information  from  the  SF  1034  or  on  attached 
documents  as  the  information  to  be  entered  into  CAPS.  DFAS  should  develop 
guidance  on  the  proper  use  of  the  SF  1034. 
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Erroneous  and  Unsupported  Payments 


Our  sample  identified  39  erroneous  payments  that  were  paid  in  the  incorrect 
amount  to  vendors  and  other  authorized  individuals.  When  projected  over  the 
entire  population  30,584  payments  were  erroneous.  Appendix  E  gives  details  of 
the  sample  projections.  We  also  questioned  the  appropriateness  of  an  additional 
31  payments  based  on  available  information.  Sufficient  documentation  and 
information  was  not  available  to  support  the  payments.  Appendix  F  gives 
details  on  each  payment. 

Incorrect  Amounts  Paid  to  Vendors.  DFAS  field  sites  made  39  vendor 
payments  in  the  incorrect  amount  resulting  in  overpayments  of  about  $1  million 
and  underpayments  of  about  $24,000.  A  payment  was  considered  erroneous  if 
the  vendor  was  paid  the  incorrect  amount  based  on  the  documents  supporting  the 
payment.  The  miscalculation  of  payment  due  dates  and  the  use  of  incorrect 
information  to  make  payments  led  to  most  of  the  erroneous  payments  that 
resulted  in  overpayments  and  underpayments.  Table  F-l  shows,  by  category, 
the  number  of  erroneous  payments  and  the  dollar  value  of  overpayments  and 
underpayments. 

Missing  or  Inconsistent  Supporting  Documents.  Thirty-one  payments,  valued 
at  about  $2.4  million,  were  made  without  proper  supporting  documents  or  the 
supporting  documents  contained  information  that  was  inconsistent  with  the 
payment.  Based  on  available  information,  we  questioned  the  appropriateness  of 
the  DFAS  field  sites  making  the  31  payments. 

Missing  Supporting  Documents.  Files  supporting  28  payments,  valued 
at  about  $2.4  million,  lacked  at  least  one  essential  document  needed  to  properly 
support  the  payment.  The  missing  invoices,  receiving  reports,  and  obligation 
documents  were  not  part  of  the  payment  file  and  were  not  otherwise  provided  to 
us  by  the  payment  office.  For  recurring  payments,  adequate  procedures  had  not 
been  established  to  ensure  that  services  were  actually  received  and  accepted  and 
receiving  reports  were  prepared  and  retained  at  the  receiving  activities.  Table 
F-2  shows  the  number  of  erroneous  payments  by  category  and  the  dollar  value 
of  the  payments  that  should  not  have  been  made  until  proper  documentation  was 
obtained.  Some  of  the  28  payments  lacked  more  than  one  type  of  supporting 
document. 


Invoices.  Payment  offices  were  unable  to  provide  us  with  the 
invoices  needed  to  support  four  sample  payments.  Technicians  made  payments 
based  on  a  statement  from  the  vendor,  a  memorandum  from  an  Army  official, 
and  travel  documents  received  from  a  travel  office.  Supporting  documentation 
was  not  available  for  one  payment  valued  at  $28.24.  Payments  should  be 
supported  by  a  request  from  the  vendor  to  be  paid  for  the  delivery  of  goods  or 
services. 


Receiving  Reports.  Fifteen  payments  were  made  without 
knowledge  that  goods  and  services  were  actually  received  and  accepted.  For 
recurring  payments,  such  as  rent  and  utility  payments,  payment  offices  did  not 
have  receiving  reports.  While  guidance  did  not  require  the  payment  offices  to 
have  receiving  reports  in  all  cases,  adequate  procedures  had  not  been  established 
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to  ensure  that  services  were  actually  received  and  accepted  and  receiving  reports 
were  prepared  and  retained  at  the  receiving  activities.  Receiving  reports  were 
not  available  to  support  three  property  lease  payments,  seven  utility  payments, 
and  five  other  payments. 

Leased  Property.  Payment  offices  made  three  payments, 
valued  at  about  $2.3  million,  for  leased  property  without  receiving  reports. 
Technicians  told  us  that  they  would  receive  notification  to  not  make  a  payment  if 
something  happened  that  the  property  was  no  longer  available.  Otherwise,  they 
automatically  paid  the  lessor.  DoD  Regulation  7000. 14-R,  volume  10,  states 
that  payments  for  continuing  services  such  as  rents,  janitorial  services,  or 
utilities,  which  are  performed  under  agency-contractor  agreements  providing 
payments  at  fixed  periodic  intervals  require  a  receiving  report  or  certification 
that  the  services  were  performed.  DoD  Regulation  7000. 14-R,  volume  10, 
further  states  that  receiving  reports  for  recurring  services  or  maintenance 
contracts  that  require  payment  of  a  flat  fee  for  a  specific  time  period  do  not  need 
to  be  physically  received  by  the  payment  office.  However,  satisfactory  controls 
need  to  be  established  to  ensure  that  a  receiving  report  was  prepared  and 
retained  at  the  receiving  activity  and  payments  were  made  only  for  satisfactory 
services  actually  received  and  accepted.  The  payment  offices  had  not 
established  administrative  controls  to  ensure  that  services  were  received  and 
accepted. 


Utility  Payments.  Seven  utility  payments,  valued  at 
about  $5,200,  were  made  without  proof  of  acceptance  of  services.  The  utility 
payments  were  not  subject  to  the  exemption  in  DoD  Regulation  7000. 14-R, 
volume  10,  because  they  were  not  for  a  fixed  amount  each  month.  While 
payment  offices  had  receiving  reports  for  some  utility  payments  in  our  sample, 
receiving  reports  were  not  available  for  these  seven  utility  payments.  Personnel 
at  the  payment  offices  and  the  receiving  activities  told  us  they  were  not  required 
to  have  receiving  reports  for  utilities.  Payments  were  made  based  on  the 
invoices  that  had  been  sent  to  the  payment  office. 

Other  Missing  Receiving  Reports.  For  the  five  other 
payments,  payment  files  did  not  contain  receiving  reports.  When  we  requested 
the  receiving  reports,  they  could  not  be  located.  Consequently,  the  five 
payments  were  made  without  the  knowledge  that  goods  and  services  were 
actually  received  and  accepted. 

Obligating  Documents.  Payment  offices  were  unable  to  provide 
obligation  documents  for  seven  sample  payments.  For  contractual  payments, 
the  paying  office  should  have  a  signed  copy  of  the  contract  and  all  modifications 
to  the  contract.  Miscellaneous  payments  require  an  obligation  document  in 
order  to  confirm  the  obligation  to  pay  on  behalf  of  the  Government  and  to 
determine  the  proper  accounting  classification  to  charge.  For  the  seven 
payments,  either  die  payment  office  based  the  payment  on  other  than  an 
obligating  document  received  from  someone  other  than  the  contracting  or  budget 
office  or  we  could  not  determine  what  the  payment  office  used  as  an  obligating 
document. 


Use  of  Delivery  Orders.  DFAS  made  eight  payments  for 
moving  and  storage  services  that  were  paid  without  a  delivery  order.  Basic 
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ordering  agreements  specify  the  items  or  services  that  can  be  ordered  from  the 
vendor  and  provide  an  estimate  of  the  number  of  items  or  amount  of  services  to 
be  purchased.  When  it  is  time  for  an  item  or  service  to  be  ordered,  a  delivery 
order  is  issued.  The  delivery  order  identifies  the  exact  items  or  services  to  be 
received  and  obligates  the  funds  necessary  to  purchase  them.  The  eight 
payments  for  moving  and  storage  services  were  paid  like  miscellaneous 
payments  using  either  an  SF  1034  or  another  document  as  support  for  the 
payment.  The  payment  office  did  not  have  delivery  orders  or  other  obligating 
documents  to  support  the  payments.  It  is  unacceptable  to  bypass  the  contract 
requirements  by  other  documents  and  miscellaneous  payment  procedures  to 
make  payments  for  which  delivery  orders  should  have  been  issued. 

Inconsistent  Supporting  Documentation.  Available  documents 
supporting  three  other  payments,  valued  at  about  $1,956,  contained  inconsistent 
information  that  should  have  been  resolved  before  a  payment  was  made.  The 
accounting  classification  cited  on  one  payment  voucher  did  not  match  the 
contract.  Another  payment  was  made  even  though  the  contract  requirements 
had  been  exceeded.  The  third  payment  was  made  by  DFAS  San  Antonio  to  an 
individual  other  than  the  one  identified  on  the  approved  DD  Form  1556, 
“Request,  Authorization,  Agreement,  Certification  of  Training  and 
Reimbursement.  ” 

Summary 


5  C.F.R.  Part  1315  contains  strict  requirements  for  what  constitutes  properly 
supported  payments.  An  proper  invoice,  receiving  report,  and  obligating 
document  are  required  to  be  obtained  by  the  payment  office  before  most 
payments  are  made.  Invoices  received  from  vendors  should  meet  all 
requirements  of  a  proper  invoice.  Invoices  that  fail  to  meet  the  standards  need 
to  be  returned  to  the  vendor  for  correction  within  7  days.  Army  activities 
receiving  goods  and  services  should  promptly  submit  to  the  payment  office 
properly  completed  receiving  reports  that  acknowledge  receipt  and  acceptance. 
Receiving  reports  must  contain  all  required  information  or  be  returned  for 
correction.  Limited  situations  do  not  require  the  receiving  report  to  be  at  the 
payment  office.  However,  controls  must  be  in  place  to  ensure  the  service  was 
performed  in  an  acceptable  manner. 

Army  managers  must  ensure  that  personnel  at  receiving  activities  are  trained  on 
the  importance  of  recording  proper  dates  on  receiving  reports  to  prevent  the 
circumvention  of  the  PPA.  Contracting  office  personnel  need  to  ensure  that 
contracts  clearly  provide  all  the  data  needed  for  making  a  payment.  Contracts 
should  detail  the  items  or  services  being  purchased  so  invoices  and  receiving 
reports  can  be  validated.  The  Under  Secretary  of  Defense  (Comptroller)  still 
needs  to  amend  DoD  Regulation  7000. 14-R,  volume  10,  to  discontinue  allowing 
exceptions  to  requirements  for  a  proper  invoice,  specify  what  a  receiving  report 
must  contain  to  properly  support  a  payment,  and  standardize  the  rules  for 
making  properly  supported  miscellaneous  payments.  Technicians  and 
certification  officials  need  to  look  more  closely  at  the  information  that  is  entered 
into  CAPS  and  ensure  that  payments  are  properly  supported.  DFAS  and  the 
Army  should  review  and  take  appropriate  actions  to  resolve  the  erroneous  and 
other  questionable  payments  identified  in  the  sample. 
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Recommendations,  Management  Comments,  and  Audit 
Response 

C.l.  We  recommend  that  the  Assistant  Secretary  of  the  Army  (Financial 
Management  and  Comptroller),  in  coordination  with  the  Director, 
Commercial  Pay  Services,  and  the  Assistant  Secretary  of  the  Army 
(Acquisition,  Technology,  and  Logistics): 

a.  Train  personnel  at  designated  billing  offices  on  the  requirements 
for  properly  date-stamping  documents  supporting  vendor  payments. 

Army  Comments.  The  Deputy  Assistant  Secretary  of  the  Army  (Financial 
Operations)  concurred  and  stated  that  he  would  work  with  DFAS  and  the 
Assistant  Secretary  of  the  Army  (Acquisition,  Technology,  and  Logistics)  to 
implement  the  recommendation.  The  Assistant  Secretary  of  the  Army 
(Acquisition,  Technology,  and  Logistics)  did  not  provide  comments  on  the  draft 
of  this  report.  Therefore,  we  request  that  the  Assistant  Secretary  of  the  Army 
(Acquisition,  Technology,  and  Logistics)  provide  comments  on  the  final  report. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  stated  that  DFAS 
would  provide  assistance  as  requested  by  the  Army. 

b.  Train  personnel  at  Army  activities  on  the  standards  for  proper 
receipt  and  acceptance  of  goods  and  services. 

Army  Comments.  The  Deputy  Assistant  Secretary  of  the  Army  (Financial 
Operations)  concurred  and  stated  that  he  would  work  with  DFAS  and  the 
Assistant  Secretary  of  the  Army  (Acquisition,  Technology,  and  Logistics)  to 
develop  guidance  for  the  processing  of  receiving  reports.  The  Assistant 
Secretary  of  the  Army  (Acquisition,  Technology,  and  Logistics)  did  not  provide 
comments  on  the  draft  of  this  report.  Therefore,  we  request  that  the  Assistant 
Secretary  of  the  Army  (Acquisition,  Technology,  and  Logistics)  provide 
comments  on  the  final  report. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  stated  that  DFAS 
would  provide  assistance  as  requested  by  the  Army. 

c.  Cease  using  Standard  Form  1034  as  an  invoice,  receiving  report, 
and  obligation  document  and  only  allow  its  use  to  support  a  properly 
certified  payment  as  authorized  by  DoD  Regulation  7000. 14-R,  volume  10. 

Army  Comments.  The  Deputy  Assistant  Secretary  of  the  Army  (Financial 
Operations)  concurred  and  stated  that  he  would  work  with  DFAS  and  the 
Assistant  Secretary  of  the  Army  (Acquisition,  Technology,  and  Logistics)  to 
implement  the  recommendation.  The  Assistant  Secretary  of  the  Army 
(Acquisition,  Technology,  and  Logistics)  did  not  provide  comments  on  the  draft 
of  tins  report.  Therefore,  we  request  that  the  Assistant  Secretary  of  the  Army 
(Acquisition,  Technology,  and  Logistics)  provide  comments  on  the  final  report. 
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DFAS  Comments.  The  Director,  Commercial  Pay  Services,  nonconcurred  and 
stated  that  DoD  Regulation  7000. 14-R,  volume  10,  chapter  8,  allows  the  use  of 
the  SF  1034  to  make  various  miscellaneous  payments.  The  Director  also  stated 
that  DFAS  would  encourage  the  use  of  the  DD  Form  250  in  lieu  of  the  SF  1034. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  The 
SF  1034  should  be  used  as  a  payment  voucher  and  not  as  the  invoice,  receiving 
report,  or  obligation  document.  We  agree  that  DoD  Regulation  7000. 14-R, 
volume  10,  permits  the  use  of  the  SF  1034  to  make  payments.  However,  the 
SF  1034  should  be  completed  properly  and  signed  by  an  approved  certifying 
official  who  has  a  DD  Form  577,  “Signature  Card,”  on  file  with  the  field  site 
entering  the  data  in  CAPS.  The  certifying  official  must  ensure  that  the  SF  1034 
can  stand  alone  as  a  payment  voucher  and  that  appropriate  information  from 
supporting  documents  is  used  to  prepare  the  SF  1034.  The  SF  1034s  should 
contain  all  the  information  needed  to  support  a  payment,  including  the  invoice 
date,  invoice  number,  receipt  and  acceptance  dates,  and  contract  or  standard 
document  number  for  the  obligation.  DFAS  should  work  with  the  Army  to 
develop  guidance  that  specifies  how  the  SF  1034  should  be  used  in  making 
vendor  payments.  We  request  that  DFAS  reconsider  its  position  and  provide 
additional  comments  to  the  final  report. 

C.2.  We  recommend  that  the  Director,  Commercial  Pay  Services: 

a.  Direct  field  sites  to  use  the  invoice  date  for  computing  the 
payment  due  date  if  the  date  stamp  on  the  invoice  does  not  clearly  identify 
that  the  office  designated  in  the  contract  received  the  invoice. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially 
concurred  and  stated  that  a  policy  letter  will  be  issued  to  clarify  guidance  on  the 
use  of  invoice  receipt  dates.  DFAS  field  sites  will  be  advised  to  use  the  invoice 
date  for  computing  the  payment  due  date  when  the  date  stamp  on  the  invoice 
does  not  clearly  identify  receipt  by  the  designated  billing  office,  unless 
communication  with  the  designated  billing  office  can  substantiate  the  true  date  of 
receipt  on  the  invoice. 

Audit  Response.  The  DFAS  comments  were  responsive.  The  guidance  should 
help  to  ensure  that  proper  invoice  receipt  dates  are  used  in  computing  payment 
due  dates. 


b.  Direct  field  sites  to  establish  a  procedure  for  determining  the 
reasonableness  of  receipt  and  acceptance  dates  and  returning  receiving 
reports  that  provide  unreasonable  dates. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  nonconcurred  and 
stated  that  DFAS  did  not  establish  criteria  for  determining  the  reasonableness  of 
receipt  and  acceptance  dates.  The  Director  stated  that  the  ordering  service  or 
agency  was  responsible  for  determining  the  reasonableness  of  receipt  and 
acceptance  dates.  DFAS  will  continue  to  use  the  7-day  constructive  acceptance 
rule  in  the  FAR  when  appropriate. 

Audit  Response.  The  DFAS  comments  were  not  responsive.  The  ordering 
activity  is  responsible  for  establishing  the  required  receipt  dates  for  goods  and 
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services.  However,  DFAS  payment  technicians  are  the  only  individuals  in  a 
position  to  compare  the  dates  on  the  supporting  documents  and  determine  the 
reasonableness  of  the  receipt  and  acceptance  dates  provided  by  receiving 
activities.  Questionable  dates  should  be  researched  to  ensure  that  vendors  are 
paid  in  a  timely  manner  and  are  not  deprived  of  the  interest  penalties  that  they 
are  entitled  to  under  the  Prompt  Payment  Act  when  payments  are  made  late. 
We  request  that  DFAS  reconsider  its  position  and  provide  additional  comments 
to  the  final  report. 

c.  Suspend  the  current  policy  of  making  payments  for  recurring 
services  without  a  receiving  report  until  adequate  controls  are  in  place  to 
verify  that  payments  are  not  being  made  until  acceptance  occurs  and  that 
acceptance  documentation  is  properly  prepared  and  maintained. 

DFAS  Comments.  The  Director,  Commercial  Pay  Systems,  concurred  and 
stated  that  a  memorandum  will  be  issued  to  suspend  the  practice  of  making 
recurring  payments  without  a  receiving  report.  Compensating  controls  will  be 
identified  to  verify  payments  are  not  being  made  until  acceptance  occurs  and 
that  acceptance  documentation  is  properly  prepared  and  maintained. 

d.  Conduct  an  audit  of  contract  number  DABT60-97-D-0007  to 
determine  if  duplicate  or  erroneous  payments  were  made. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  perform  a  complete  review  of  the  payments  on  the 
contract. 


e.  Review  and  resolve  those  erroneous  payments  and  the  other 
questionable  payments  that  are  considered  significant. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  questionable  payments  would  be  resolved. 

C.3.  We  recommend  that  the  Assistant  Secretary  of  the  Army  (Acquisition, 
Technology,  and  Logistics)  direct  contracting  offices  to: 

a.  Identify  a  single  payment  office  for  making  payments  on  each 
delivery  order. 

b.  Issue  delivery  orders  for  moving  and  storage  services  in  support 
of  basic  ordering  agreements. 

c.  Issue  contracting  documents  that  contain  accurate  Data  Universal 
Numbering  System  numbers  and  Contractor  Activity  Government  Entity 
codes  and  that  require  vendors  to  submit  invoices  that  meet  the 
requirements  of  5  Code  of  Federal  Regulations  Part  1315  directly  to 
payment  offices  unless  the  invoices  require  certification  by  installation 
personnel. 

Army  Comments.  The  Assistant  Secretary  of  the  Army  (Acquisition, 
Technology,  and  Logistics)  did  not  provide  comments  on  the  draft  of  this  report. 
Therefore,  we  request  that  the  Army  provide  comments  on  the  final  report. 
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Appendix  A.  Audit  Process 

Scope 


Work  Performed.  We  evaluated  the  controls  associated  with  the  two  versions 
of  CAPS  and  the  computation  of  vendor  payments  at  DFAS  field  sites, 

USPFOs,  and  several  other  DoD  organizations.  During  FY  2000,  about 
902,000  vendor  payments,  valued  at  $13.7  billion,  were  made  using  CAPS.  A 
random  sample  of  300  of  the  236,940  payments  made  from  May  1  through 
July  31,  2000,  was  reviewed.  We  considered  the  organizational  and  system 
changes  made  by  DFAS  field  sites  since  July  31,  2000. 

General  Accounting  Office  High-Risk  Area.  GAO  identified  several  high-risk 
areas  in  the  DoD.  This  report  provides  coverage  of  the  Defense  Financial 
Management  and  Information  Management  and  Technology  high-risk  areas. 

Methodology 

To  assess  controls  over  CAPS(W)  and  CAPS  Clipper,  we  reviewed  system 
access  lists,  compared  the  access  levels  of  employees  to  their  job  position, 
observed  system  access  by  users,  and  discussed  procedures  for  controlling  and 
changing  passwords  with  systems  personnel.  We  also  reviewed  system  manuals 
and  discussed  the  functionality  of  the  two  versions  of  CAPS  with  systems 
personnel  at  DFAS  Indianapolis  and  the  other  field  sites. 

From  data  files  obtained  from  DFAS  Indianapolis,  we  randomly  selected 
300  vendor  payments  made  using  CAPS  from  May  1  through  July  31,  2000. 
CAPS(W)  was  used  by  six  field  sites  assigned  to  DFAS  Indianapolis  (Operating 
Forces)  and  the  DFAS  field  sites  located  in  San  Antonio,  Texas;  and  Norfolk, 
Virginia.  DFAS  Europe,  DFAS  Rock  Island,  DFAS  St.  Louis,  the  54  USPFOs, 
and  several  other  DoD  organizations  used  CAPS  Clipper.  From  August  2000 
through  July  2001,  we  reviewed  the  operations  and  support  for  the  payments  at 
these  locations  to  determine  whether  payments  were  properly  authorized, 
approved,  and  supported.  Obligation  documents,  invoices,  receiving  reports, 
and  payment  vouchers  were  reviewed  for  accuracy  and  propriety. 

We  reviewed  vendor  payment  operations  at  DFAS  Indianapolis,  DFAS  Europe, 
DFAS  Lawton,  DFAS  Norfolk,  DFAS  Orlando,  DFAS  Rock  Island,  DFAS 
Rome,  DFAS  San  Antonio,  and  DFAS  St  Louis.  We  also  reviewed  operations 
at  USPFO  Indiana,  Indianapolis,  Indiana;  USPFO  Ohio,  Columbus,  Ohio;  and 
USPFO  Oklahoma,  Oklahoma  City,  Oklahoma.  We  also  obtained  and  analyzed 
data  from  DFAS  Lexington,  DFAS  Seaside,  and  21  other  USPFOs.  We 
compared  payment  vouchers  to  source  documents  to  determine  whether 
payments  were: 

•  properly  supported,  in  the  correct  amount,  and  cited  proper 
appropriation  data; 
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•  based  on  the  correct  invoice  receipt  dates  and  receipt  and  acceptance 
dates; 

•  properly  certified;  and 

•  sent  to  the  correct  vendor  via  the  required  means  of  delivery. 

We  also  reviewed  guidance  for  making  vendor  payments  and  compared 
guidance  issued  by  DFAS  Arlington,  Arlington,  Virginia,  and  DFAS 
Indianapolis  with  guidance  in  5  C.F.R.  Part  1315,  the  FAR,  DFARS  subpart 
232.9,  and  DoD  Regulation  7000. 14-R,  volumes  5  and  10.  We  contacted 
selected  receiving  activities  to  determine  whether  they  received  goods  and 
services  for  which  payments  had  been  made.  We  also  contacted  several  vendors 
to  determine  the  status  of  invoices  and  whether  payments  had  been  received. 

We  assessed  improvements  in  vendor  payment  operations  by  assessing  changes 
in  guidance  and  the  actions  taken  by  DFAS  and  the  Army  in  response  to  prior 
reviews  of  vendor  payment  operations.  We  held  discussions  with  key  DFAS 
and  Army  financial  managers.  At  each  location  we  visited,  we  also  determined 
actions  taken  to  resolve  older  unpaid  invoices  by  judgmentally  selecting 
10  invoices  from  a  listing  of  unpaid  invoices.  We  determined  the  status  of  the 
invoices,  identified  problems  that  delayed  the  payment  of  the  invoices,  and  for 
those  invoices  that  were  paid  as  of  the  date  of  our  visit,  we  reviewed  the 
documents  supporting  the  payments. 

Use  of  Computer-Processed  Data.  Although  we  relied  on  computer-processed 
data  from  the  two  versions  of  CAPS,  we  did  not  evaluate  the  adequacy  of  all  the 
system’s  general  and  application  controls.  We  determined  that  password  and 
system  controls  over  CAPS  were  not  adequate  and  data  entered  at  one  location 
could  be  altered  or  removed  by  individuals  at  other  locations.  However,  we 
established  data  reliability  for  the  payments  we  reviewed  by  comparing  data 
output  to  source  documents  and  through  discussions  with  vendors  and  receiving 
activities.  Our  tests  disclosed  that  the  data  were  sufficiently  reliable  to  support 
the  audit  conclusions  and  recommendations. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  financial-related  audit 
from  August  2000  through  October  2001  in  accordance  with  generally  accepted 
government  auditing  standards. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 

Management  Control  Program  Review 


DoD  Directive  5010.38  “Management  Control  (MC)  Program,”  August  26, 
1996,  and  DoD  Instruction  5010.40,  “Management  Control  (MC)  Program 
Procedures,”  August  28,  1996,  require  DoD  organizations  to  implement  a 
comprehensive  system  of  management  controls  that  provides  reasonable 
assurance  that  programs  are  operating  as  intended  and  to  evaluate  the  adequacy 
of  the  management  controls. 
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Scope  of  Review  of  the  Management  Control  Program.  We  reviewed  the 
adequacy  of  management  controls  over  vendor  payments  made  using  CAPS. 
Specifically,  we  reviewed  management  controls  over  vendor  payments  at  the 
DFAS  field  sites.  We  also  reviewed  management’s  self-evaluation  of  those 
controls. 

Adequacy  of  Management  Controls.  A  material  management  control 
weakness  as  defined  by  DoD  Instruction  5010.40  was  identified  in  controls 
associated  with  making  vendor  payments  using  CAPS.  Management  controls 
were  not  adequate  to  control  access  to  CAPS  and  to  ensure  that  all  vendor 
payments  were  properly  supported  and  made  for  correct  amounts. 
Recommendations  A.,  B.,  and  C.,  if  implemented,  will  improve  controls  over 
vendor  payments.  A  copy  of  the  report  will  be  provided  to  the  senior  official  in 
charge  of  management  controls  in  DFAS. 

Adequacy  of  Management’s  Self-Evaluation.  DFAS  managers  identified 
vendor  payments  as  an  assessable  unit  and  in  our  opinion  correctly  identified  the 
risk  associated  with  vendor  payments  as  high.  DFAS  Indianapolis  did  not 
identify  controls  over  the  processing  of  CAPS  payments  as  a  management 
control  weakness  in  its  FYs  2000  and  2001  Annual  Statements  of  Assurance. 
However,  DFAS  Columbus  and  DFAS  Kansas  City  as  well  as  several  of  the 
DFAS  field  sites  had  reported  significant  control  issues  with  CAPS.  As 
highlighted  in  this  report,  CAPS  has  significant  management  control  issues  that 
should  be  reported  as  a  material  weakness. 
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Appendix  B.  Prior  Coverage 


During  the  last  5  years,  GAO  and  the  Inspector  General,  DoD,  have  issued 
several  audit  reports  discussing  issues  related  to  vendor  payments. 

General  Accounting  Office 

GAO  Report  No.  GAO-01-309  (OSD  Case  No.  3029),  “Excess  Payments  and 
Underpayments  Continue  to  be  a  Problem  at  DoD,”  February  22,  2001 

GAO  Report  No.  GAO/AIMD-OO-IO  (OSD  Case  No.  1919),  “Increased 
Attention  Needed  to  Prevent  Billions  in  Improper  Payments,”  October  29,  1999 

GAO  Report  No.  GAO/AIMD-98-274  (OSD  Case  No.  1687),  “Improvements 
Needed  in  Air  Force  Vendor  Payment  Systems  and  Controls,”  September  28, 
1998 

GAO  Report  No.  GAO/OSI-98-15  (OSD  Case  No.  1687-A),  “Fraud  by  an  Air 
Force  Contracting  Official,”  September  23,  1998 

Inspector  General,  DoD 


Inspector  General,  DoD,  Report  No.  D-2002-008,  “Controls  Over  the 
Computerized  Accounts  Payable  System  at  Defense  Finance  and  Accounting 
Service  Kansas  City,”  October  19,  2001 

Inspector  General,  DoD,  Report  No.  D-2001-101,  “Controls  Over  Electronic 
Document  Management,”  April  16,  2001 

Inspector  General,  DoD,  Report  No.  D-2001-075,  “Standard  Procurement 
System  Use  and  User  Satisfaction,”  March  13,  2001 

Inspector  General,  DoD,  Report  No.  D-2001-029,  “General  Controls  Over  the 
Electronic  Document  Access  System,”  December  27,  2000 

Inspector  General,  DoD,  Report  No.  D-2000-139,  “Controls  Over  the 
Integrated  Accounts  Payable  System,”  June  5,  2000 
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Appendix  C.  Standard  Office  Structure  for 

Making  Vendor  Payments 


Centralized  Mailroom.  The  centralized  mailroom  should  be  located  and 
controlled  outside  of  the  vendor  payment  operation.  All  incoming  documents, 
including  mail  delivered  by  the  U.S.  Postal  Service,  hand  delivered  items, 
express  mail,  and  facsimile  messages  that  support  vendor  payments  should  be 
received  and  date-stamped  in  the  centralized  mailroom.  The  mailroom  should 
be  a  secure  location  and  all  supporting  documents  should  be  maintained  under 
its  control  until  transferred  to  the  document  management  section  for  processing. 
Sites  using  the  RightFAX  system  can  receive  supporting  documents  directly  in 
the  document  management  section  since  the  RightFAX  system  provides  a  means 
to  control  the  date  stamp  placed  on  the  document. 

Vendor  Payment  Office.  In  order  to  standardize  the  vendor  payment  office 
structure,  each  vendor  payment  office  should  contain  the  following  four 
sections. 

Document  Management  Section.  The  document  management  section 
should  be  a  secure  location  within  the  vendor  payment  office.  The  section 
should  be  staffed  with  experienced  vendor  pay  technicians  that  screen  all 
incoming  vendor  payment  supporting  documents,  and  either  enter  them  into 
CAPS  or  log  and  return  them  to  originators  with  an  explanation  as  to  why  the 
documents  are  not  proper.  This  section  should  also  track  and  control  payment 
folders  and  each  supporting  document  until  the  payment  is  made  and  the 
documents  are  attached  to  the  disbursement  voucher. 

Payment  Computation  Section.  The  payment  computation  section 
should  consist  of  vendor  pay  technicians  responsible  for  ensuring  that  all 
payment  documents  for  contractual  and  miscellaneous  payments  are  properly 
entered  into  CAPS  and  properly  support  the  payments.  The  technician  should 
also  determine  whether  the  EFT  information  contained  in  CAPS  is  current  by 
comparing  the  data  with  the  CEFT  database.  If  errors  are  detected,  the 
information  should  be  researched  and  returned  to  the  input  or  vendor 
maintenance  technician  for  correction.  Once  all  documents  are  obtained  and 
payment  information  reviewed,  the  technician  should  compute  the  payment  in 
CAPS,  ensure  that  the  payment  is  properly  prevalidated,  and  produce  a 
disbursement  voucher. 

Certification  Section.  The  certification  section  should  be  comprised  of 
experienced  vendor  pay  technicians  who  have  been  formally  designated  as 
certifying  officials.  This  section  is  responsible  for  ensuring  that  all  payments 
are  legal,  correctly  computed  for  payment,  are  supported  by  proper  supporting 
documents,  and  are  sent  to  the  correct  EFT  account  or  remittance  address. 
Certification  officials  should  also  sign  each  voucher  using  either  a  manual  or 
electronic  signature  certifying  that  the  payments  are  legal,  proper,  and  correct. 
Certification  officials  should  be  responsible  for  performing  the  daily  download 
of  disbursing  information  from  ODS  to  CAPS  and  the  upload  of 
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payment  information  from  CAPS  to  ODS.  The  disbursing  officer  should  be 
provided  with  a  certification  statement  that  the  payments  being  submitted  for 
disbursement  have  all  been  properly  certified. 

Reports  and  Reconciliation  Section.  The  reports  and  reconciliation 
section  should  be  staffed  with  experienced  vendor  pay  technicians  or  accountants 
responsible  for  conducting  research  and  working  management  reports.  This 
section  should  also  work  with  activities  to  obtain  missing  documentation  needed 
to  properly  support  payments  that  appear  on  overage  listings.  A  limited  number 
of  individuals  within  this  section  should  be  responsible  for  entering  and  updating 
vendors’  EFT  and  check  remittance  information  in  CAPS. 

The  figure  shows  a  proposed  standard  office  structure  that  would  provide  proper 
segregation  of  duties  within  a  field  site  processing  vendor  payments. 
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Appendix  D.  Guidance  on  Supporting 

Documentation 


The  principal  guidance  used  for  making  payments  to  vendors  is  the  PPA,  as 
implemented  in  5  C.F.R.  Part  1315,  “Prompt  Payment;  Final  Rule,” 

September  29,  1999.  The  requirements  for  supporting  documentation  are 
further  defined  in  FAR  Subpart  32.9,  “Prompt  Payment”;  DoD  FAR 
Supplement  Subpart  232.9,  “Prompt  Payment”;  and  DoD  Regulation 
7000. 14-R,  volume  10,  “Contract  Payment  Policy  and  Procedures,”  November 
1999. 

On  August  28,  2000,  a  proposed  rule  was  published  for  comment  in  the  Federal 
Register,  “Federal  Acquisition  Regulation;  Prompt  Payment  and  the  Recovery 
of  Overpayment;  Proposed  Rule.  ”  The  proposed  change  revises  the  FAR  to 
incorporate  5  C.F.R.  Part  1315  and  implements  a  GAO  recommendation  to 
require  contractors  who  have  been  overpaid  to  notify  contracting  officers  of 
overpayments.  The  FAR  council  must  issue  a  Federal  Acquisition  Circular  to 
change  the  FAR.  DoD  FAR  Supplement  Subpart  232.9,  “Prompt  Payment,” 
also  has  not  been  changed. 

In  Inspector  General,  DoD,  Report  No.  D-2000-139,  “Controls  Over  the 
Integrated  Accounts  Payable  System,”  June  5,  2000,  we  recommended  that 
DoD  Regulation  7000. 14-R,  volume  10,  be  amended  to  fully  comply  with  the 
requirements  in  5  C.F.R.  Part  1315  and  include  standardized  rules  for  making 
properly  supported  miscellaneous  payments.  The  Under  Secretary  of  Defense 
(Comptroller)  stated  that  DoD  Regulation  7000. 14-R,  volume  10,  would  not  be 
changed  until  5  C.F.R.  Part  1315  is  incorporated  in  the  FAR. 

DFAS  Indianapolis  issued  further  guidance  in  DFAS  Indianapolis 
Regulation  37-1,  Chapter  9,  “Vendor  Pay,”  dated  January  2000.  With  the 
exception  of  an  invoice  number  and  the  name  of  the  vendor  on  receiving 
reports,  the  DFAS  Indianapolis  guidance  echoed  the  requirements  in  5  C.F.R. 
Part  1315  for  what  information  must  be  found  on  the  supporting  documentation. 

Invoices.  5  C.F.R.  Part  1315  requires  that  the  vendor  send  an  invoice  to  the 
designated  billing  office  specified  in  the  contract  when  goods  are  delivered  or 
services  performed.  The  designated  billing  office  is  required  to  immediately 
date-stamp  the  invoice  and  perform  a  review  to  determine  whether  the  invoice  is 
proper  for  payment.  If  the  invoice  is  determined  to  be  proper,  it  should  be  sent 
to  the  payment  office  for  entry  into  CAPS  and  payment  as  required  by  the  PPA. 
If  determined  to  be  improper,  the  invoice  should  be  returned  to  the  vendor 
within  7  days  of  receipt  (for  most  invoices),  identifying  all  defects  that 
prevented  payment  and  requesting  that  the  vendor  send  a  clearly  marked 
corrected  invoice  to  the  designated  billing  office  for  payment. 
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Specifically,  5  C.F.R.  Part  1315.9,  “Required  Documentation,”  states  that: 


(b)  The  following  correct  information  constitutes  a  proper  invoice  and 

is  required  as  payment  documentation: 

(1)  Name  of  vendor; 

(2)  Invoice  date; 

(3)  Government  contract  number,  or  other  authorization  for  delivery 
of  goods  or  services; 

(4)  Vendor  invoice  number,  account  number,  and/or  any  other 
identifying  number  agreed  to  by  contract; 

(5)  Description  (including  for  example,  contract  line/subline 
number),  price,  and  quantity  of  goods  and  services  rendered; 

(6)  Shipping  and  payment  terms  (unless  mutually  agreed  that  this 
information  is  only  required  in  the  contract); 

(7)  Taxpayer  Identification  Number  (TIN),  unless  agency  procedures 
provide  otherwise; 

(8)  Banking  information,  unless  agency  procedures  provide 
otherwise,  or  except  in  situations  where  the  EFT  requirement  is 
waived  under  31  CFR  208.4; 

(9)  Contact  name  (where  practicable),  title  and  telephone  number; 

(10)  Other  substantiating  documentation  or  information  required  by 
the  contract. 

In  addition  to  these  requirements,  the  proposed  change  to  the  FAR  specifies  EFT 
requirements  and  states  that  contractors  should  assign  an  identification  number  to  each 
invoice. 

DoD  Regulation  7000. 14-R,  volume  10,  allows  exceptions  to  requirements  for  a  valid 
invoice.  DoD  Regulation  7000. 14-R,  volume  10,  states  that  it  is  not  necessary  for  an 
invoice  to  be  free  of  defects  in  order  for  it  to  be  proper  and  create  a  valid  demmid  on 
the  Government;  the  approving  activity  determines  whether  a  valid  demand  exists. 

These  exceptions  are  contrary  to  the  requirements  in  5  C.F.R.  Part  1315.  In  assessing 
whether  an  invoice  was  proper,  we  used  the  requirements  in  5  C.F.R.  Part  1315. 
Specifically,  invoices  were  considered  improper  if  they  did  not  contain  a  contract  or 
obligating  document  number,  or  did  not  adequately  describe  what  was  purchased  or  the 
description  was  inconsistent  with  the  contract.  The  FAR  requires  that  an  invoice  that  is 
missing  required  data  be  returned  to  the  vendor,  which  can  make  the  needed  corrections 
and  resubmit  a  clearly  marked  corrected  invoice.  Consequently,  invoices  were  also 
considered  improper  if  they  were  altered. 
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Receiving  Reports.  The  PPA  requires  that  receipt  and  acceptance  be  promptly 
recorded  at  the  time  of  delivery  of  goods  or  completion  of  services.  Receiving 
activities  were  required  to  submit  a  receiving  report  immediately  upon  each  delivery  of 
goods  or  completion  of  services  unless  the  contract  stated  that  partial  payment  was  not 
authorized.  Receiving  activities  were  to  forward  a  proper  receiving  report  to  the 
payment  office  by  the  fifth  working  day  after  acceptance.  5  C.F.R.  Part  1315.9  states 
that: 


(c)  The  following  information  from  receiving  reports,  delivery  tickets, 
and  evaluated  receipts  is  required  as  payment  documentation: 

(1)  Name  of  vendor; 

(2)  Contract  or  other  authorization  number; 

(3)  Description  of  goods  or  services; 

(4)  Quantities  received,  if  applicable; 

(5)  Date(s)  goods  were  delivered  or  services  were  provided; 

(6)  Date(s)  goods  or  services  were  accepted; 

(7)  Signature  (or  electronic  alternative  when  supported  by 
appropriate  internal  controls),  printed  name,  telephone 
number,  mailing  address  of  the  receiving  official,  and  any 
additional  information  required  by  the  agency. 

The  proposed  change  to  the  FAR  basically  restates  existing  requirements 
for  receiving  reports.  The  proposed  change  states  that: 

(c)  Authorization  to  pay.  ...The  receiving  report  or  other 
Government  documentation  authorizing  payment  must,  as  a  minimum, 
include  the  following: 

(1)  Contract  number  or  other  authorization  for  supplies  delivered  or 
services  performed. 

(2)  Description  of  supplies  delivered  or  services  performed. 

(3)  Quantities  of  supplies  received  and  accepted  or  services 
performed,  if  applicable. 

(4)  Date  supplies  delivered  or  services  performed. 
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(5)  Date  that  the  designated  Government  Official  - 

(i)  Accepted  the  supplies  or  services;  or 

(ii)  Approved  the  progress  payment  request,  if  the  request 
is  being  made  under  the  clause  at  52.232-5,  Payments 
Under  Fixed-Price  Construction  Contracts,  or  the  clause 
at  52.232-10,  Payment  Under  Fixed-Price  Architect- 
Engineering  Contracts. 

(6)  Signature,  printed  name,  title,  mailing  address,  and  telephone 

number  of  the  designated  Government  official  responsible  for 

acceptance  or  approval  functions. 

DoD  Regulation  7000. 14-R,  volume  10,  does  not  specify  what  a  receiving 
report  must  contain  to  properly  support  a  payment. 

Contracts.  To  properly  support  a  payment,  the  paying  office  must  have  a 
signed  contract  or  other  authorization  document  against  which  payment  is  being 
made.  5  C.F.R.  Part  1315.9  states  that: 

The  following  information  from  the  contract  is  required  as  payment 
documentation: 

(1)  Payment  due  date(s)  as  defined  in  Sec.  1315.4(g); 

(2)  A  notation  in  the  contract  that  partial  payments  are 
prohibited,  if  applicable; 

(3)  For  construction  contracts,  specific  payment  due  dates  for 
approved  progress  payments  or  milestone  payments  for 
completed  phases,  increments,  or  segments  of  the  project; 

(4)  If  applicable,  a  statement  that  the  special  payment  provisions 
of  the  Packers  and  Stockyard  Act  of  1921  (7  U.S.C.  182(3)), 
or  the  Perishable  Agricultural  Commodities  Act  of  1930 
(7  U.S.C.  499a(4)),  or  Fish  and  Seafood  Promotion  Act  of 
1986  (16  U.S.C.  4003(3))  shall  apply; 

(5)  Where  considered  appropriate  by  the  agency  head,  the 
specified  acceptance  period  following  delivery  to  inspect 
and/or  test  goods  furnished  or  to  evaluate  services  performed 
is  stated; 

(6)  Name  (where  practicable),  title,  telephone  number,  and 
complete  mailing  address  of  officials  of  the  Government’s 
designated  agency  office,  and  of  the  vendor  receiving  the 
payments; 
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(7)  Reference  to  requirements  under  the  Prompt  Payment  Act, 
including  the  payment  of  interest  penalties  on  late  invoice 
payments  (including  progress  payments  under  construction 
contracts); 

(8)  Reference  to  requirements  under  the  Debt  Collection 
Improvement  Act  (Pub.  L.  104-134,  110  Stat.  1321) 
including  the  requirement  that  payments  must  be  made 
electronically  except  in  situations  where  the  EFT  requirement 
is  waived  under  31  CFR  208.4.  Where  electronic  payment  is 
required,  the  contract  will  stipulate  that  banking  information 
must  be  submitted  no  later  than  the  first  request  for  payment. 
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Appendix  E.  Statistical  Sampling  Methodology 

Sampling  Plan 


Sampling  Purpose.  The  purpose  of  the  statistical  sampling  plan  was  to  estimate 
the  number  of  vendor  payments  that  did  not  have  proper  documentation  by  type 
of  payment  and  type  of  document.  The  statistical  sampling  plan  was  also  used 
to  estimate  the  number  of  erroneous  payments,  once  it  was  determined  that  a 
payment  was  not  properly  supported.  The  payments  were  reviewed  to 
determine  whether  documentation  was  adequate  and  complied  with  the  PPA. 

Universe  Represented.  DFAS  Indianapolis  provided  a  database  of  vendor 
payments  made  using  CAPS  from  May  1  through  July  31,  2000.  The  file 
contained  records  on  236,940  vendor  payments.  The  total  dollar  value  of  the 
vendor  payments  in  the  population  was  $4. 1  billion. 

Sampling  Design.  The  sampling  design  used  to  determine  whether  or  not  the 
vendor  payments  had  proper  documentation  was  a  stratified  attribute  design. 
The  population  was  divided  into  three  strata:  payments  valued  at  less  than 
$2,500,  payments  valued  at  least  $2,500  but  less  than  $1  million,  and  payments 
valued  at  $1  million  or  more.  A  total  of  300  payments  (148  contractual  and 
152  miscellaneous)  were  randomly  selected:  160  from  the  first  stratum, 

80  from  the  second  stratum,  and  60  from  the  third  stratum. 

Sampling  Results 


Table  E-l  identifies  the  statistical  estimates  of  vendor  payments  that  were  not 
properly  supported  by  type  of  payment. 


Table  E-l.  Payments  Not  Properly  Supported 
(99-Percent  Confidence  Level) 

Type  of 
Payment 

Lower  Bound 

Point  Estimate 

Upper  Bound 

Contractual 

61,937 

80,620 

99,302 

Miscellaneous 

82,018 

100,787 

119,556 

We  are  99-percent  confident  that  from  61,937  to  99,302  contractual  payments 
were  not  properly  supported.  Also,  we  are  99-percent  confident  that  from 
82,018  to  1 19,556  miscellaneous  payments  were  not  properly  supported.  Table 
E-2  identifies  the  statistical  estimates  of  contractual  payments  that  were  not 
properly  supported  by  document  type. 
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Table  E-2.  Contractual  Payments  Not  Properly 

Supported  by  Document  Type 
(99-Percent  Confidence  Level) 

Type  of 
Document 

Lower  Bound 

Point  Estimate 

Upper  Bound 

Invoices 

18,868 

32,437 

46,006 

Receiving 

Reports 

55,806 

74,000 

92,194 

Contracts 

3,817 

12,532 

21,248 

Incorrect 
Receiving 
Report  Dates 

23,669 

37,949 

52,230 

We  are  99-percent  confident  that  from  18,868  to  46,006  vendor  payments  were 
not  properly  supported  due  to  improper  invoices.  We  are  99-percent  confident 
that  from  55,806  to  92,194  vendor  payments  were  not  properly  supported  due  to 
improper  receiving  reports.  We  are  99-percent  confident  that  from  3,817  to 
21,248  vendor  payments  were  not  properly  supported  due  to  improper 
obligation  documents.  We  are  also  99-percent  confident  that  from  23,669  to 
52,230  payments  were  made  using  receiving  reports  containing  inaccurate  dates. 

Table  E-3  identifies  the  statistical  estimates  of  miscellaneous  payments  that  were 
not  properly  supported  by  document  type. 


Table  E-3.  Miscellaneous  Payments  Not  Properly 

Supported  by  Document  Type 
(99-Percent  Confidence  Level) 

Type  of 
Document 

Lower  Bound 

Point  Estimate 

Upper  Bound 

Invoices 

7,253 

17,507 

27,761 

Receiving 

Reports 

82,018 

100,787 

119,556 

Obligation 

Documents 

7,260 

17,022 

26,783 

We  are  99-percent  confident  that  from  7,253  to  27,761  vendor  payments  were 
not  properly  supported  due  to  improper  invoices.  We  are  99-percent  confident 
that  from  82,018  to  1 19,556  vendor  payments  were  not  properly  supported  due 
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to  improper  receiving  reports.  We  are  99-percent  confident  that  from  7,260  to 
26,783  vendor  payments  were  not  properly  supported  due  to  improper 
obligation  documents. 

Table  E-4  identifies  the  statistical  estimates  of  vendor  payments  that  were 
erroneous  by  type  of  payment. 


Table  E-4.  Erroneous  Payments 
(99-Percent  Confidence  Level) 

Type  of 
Payment 

Lower  Bound 

Point  Estimate 

Upper  Bound 

Contractual 

5,775 

15,549 

25,323 

Miscellaneous 

5,341 

15,035 

24,730 

All 

17,451 

30,584 

43,717 

We  are  99-percent  confident  that  from  17,451  to  43,717  vendor  payments  were 
made  erroneously  to  vendors.  We  are  99-percent  confident  that  from  5,775  to 
25,323  contract  payments  were  made  erroneously.  We  are  99-percent  confident 
that  from  5,341  to  24,730  miscellaneous  payments  were  made  erroneously. 

Each  of  the  individual  estimates  is  projected  at  the  99-percent  confidence  level. 
However,  taking  a  conservative  approach,  reviewing  each  of  the  1 1  estimates  as 
an  independent  projection,  we  estimate  the  overall  confidence  level  for  all  1 1 
estimates  simultaneously  is  approximately  90-percent. 
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Appendix  F.  Erroneous  and  Unsupported 

Payments 


From  our  sample  of  payments  made  from  May  1  through  July  31,  2000,  we 
identified  39  erroneous  payments.  We  considered  a  payment  to  be  erroneous  if 
the  vendor  was  paid  the  incorrect  amount.  We  identified  $1,000,025.53  in 
overpayments  and  $23,959.98,  in  underpayments.  Thirty-one  additional 
payments,  valued  at  about  $2.4  million,  were  made  without  proper  supporting 
documents  or  the  supporting  documents  contained  information  that  was 
inconsistent  with  the  payment.  Based  on  available  information,  we  question  the 
appropriateness  of  these  31  payments. 

Incorrect  Amounts  Paid  to  Vendors 


DFAS  field  sites  made  39  vendor  payments  in  the  incorrect  amount  resulting  in 
overpayments  of  about  $1  million  and  underpayments  of  about  $24,000.  A 
payment  was  considered  erroneous  if  the  vendor  was  paid  the  incorrect  amount 
based  on  the  documents  supporting  the  payment.  Table  F-l  shows,  by  category, 
the  number  of  erroneous  payments  and  dollar  value  of  overpayments  and 
underpayments. 


Table  F-l.  Incorrect  Amounts  Paid  to  Vendors 

Category 

Number  of 
Erroneous 
Payments 

Amount  Overpaid 

Amount  Underpaid 

Miscalculation 
of  Payment 

Due  Date 

16 

$  235.94 

$  520.76 

Incorrect 
Information 
Entered  in 

CAPS 

16 

967,869.33 

18,678.29 

Vendor  Paid 
More  Than 
Amount  Due 

5 

31,920.26 

0 

Discounts 

Improperly 

Taken 

2 

0 

4,760.93 

Total 

39 

$1,000,025.53 

$23,959.98 
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Miscalculation  of  Payment  Due  Date.  Technicians  miscalculated  the  payment 
due  dates  on  16  payments.  As  a  result,  DFAS  overpaid  eight  invoices  by 
$235.94  and  underpaid  eight  invoices  by  $520.76.  In  each  of  the  16  cases,  the 
payments  were  not  paid  on  the  expected  payment  date  and  the  interest  payment 
was  not  recalculated.  As  a  result,  the  vendors  were  paid  the  incorrect  amount 
of  interest.  The  following  list  identifies  information  on  each  of  the  16 
payments,  including  the  amount  of  the  overpayment  or  underpayment  which 
occurred  and  whether  subsequent  action  was  taken  to  recover  the  overpayment 
or  pay  the  vendor  the  underpaid  amount. 


Payment 

Office 

Voucher 

Number 

Voucher 

Date 

Overpayment 

(Underpayment)1 

Remedial 
Action  Taken 

Defense  Agency 

Financial 

Services  304315 

6/30/00 

$  5.48 

No 

Europe 

243978 

6/16/00 

1.13 

No 

Lawton 

252830 

6/1/00 

(3.66) 

No 

Lexington 

214614 

5/16/00 

2.09 

No 

Lexington 

201071 

7/27/00 

203.04 

No 

Orlando 

204886 

5/2/00 

10.23 

No 

Orlando 

209467 

5/9/00 

(307.99) 

No 

Orlando 

237629 

6/15/00 

12.42 

No 

Orlando 

246045 

6/27/00 

1.26 

No 

Rock  Island 

270391 

5/30/00 

(195.69) 

No 

San  Antonio 

251487 

5/31/00 

0.29 

No 

San  Antonio 

258013 

6/9/00 

(0.40) 

No 

San  Antonio 

266817 

6/22/00 

(1.02) 

No 

San  Antonio 

263436 

7/18/00 

(6.09) 

No 

San  Antonio 

267187 

7/24/00 

(1.45) 

No 

St.  Louis 

270979 

5/30/00 

(4.46) 

Yes 

Incorrect  Information  Entered  Into  CAPS.  Technicians  incorrectly  entered 
the  dates  used  to  calculate  payment  due  dates  and  the  amount  due  vendors.  In 
addition,  payment  remittance  information  was  not  changed  promptly.  Incorrect 
information  in  CAPS  caused  5  overpayments  totaling  $967,869.33  and  11 
underpayments  totaling  $18,678.29.  The  following  list  provides  pertinent 
information  on  the  16  erroneous  payments. 


1  Overpayments  and  underpayments  are  estimates  based  on  straight-line  interest  at  the  rate  in  effect  at  the 
time  of  payment. 
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Payment 

Office 

Voucher 

Number 

Voucher 

Date 

Overpayment 

(Underpayment) 

Remedial 
Action  Taken 

DNO 

mssmsm 

7/6/00 

$  (7.62) 

No 

Europe 

237781 3 

5/10/00 

937,918.00 

Yes 

Europe 

2861884 

6/14/00 

(1,252.00) 

No 

Europe 

2732965 

6/30/00 

116.88 

Yes 

Lawton 

2652692 

7/19/00 

3.30 

No 

Rock  Island 

2753094 

5/10/00 

1.54 

No 

Rock  Island 

2784645 

5/17/00 

29,829.61 

Yes 

Rock  Island 

2824722 

5/26/00 

(1,836.25) 

No 

Rock  Island 

21219T 

6/6/00 

(7.51) 

No 

Rock  Island 

2701972 

6/29/00 

(5.78) 

No 

Rock  Island 

2758234 

7/12/00 

(2.68) 

No 

Rock  Island 

2758384 

7/12/00 

(13,275.36) 

No 

Rome 

2200973 

5/23/00 

(1,639.86) 

Yes 

San  Antonio 

2693372 

5/26/00 

(0.84) 

No 

St.  Louis 

2794802 

6/21/00 

(648.68) 

Yes 

USPFO 

California 

2571682 

7/7/00 

(1.71) 

No 

Entering  Information  in  CAPS.  Technicians  did  not  correctly  enter 
information  that  affected  payment  amounts  and  the  vendor  entitled  to  payment. 
The  dates  used  to  calculate  the  payment  due  dates  were  also  not  entered 
correctly.  Technicians  sometimes  entered  the  wrong  date  or  used  an  incorrect 
date  from  the  supporting  documentation. 

•  A  technician  at  DFAS  Europe  entered  the  total  amount  invoiced  for 
the  month  instead  of  the  amount  due  to  vendor  shown  on  the  invoice, 
The  vendor  had  previously  requested  95  percent  of  the  anticipated 
monthly  charge  and  only  requested  the  difference  between  the  actual 
monthly  charges  and  the  amount  previously  invoiced.  As  a  result, 
the  vendor  was  overpaid  by  about  $937,918.  The  overpayment  was 
recouped  2  months  later. 

•  A  payment  made  by  DFAS  Rock  Island  for  $29,829.61  was  sent  to 
the  incorrect  vendor.  A  modification  to  the  contract  changed  the 
vendor  name  and  address.  DFAS  Rock  Island  had  the  modification 
and  corrected  part  of  the  information  but  failed  to  change  the  EFT 
and  remittance  information  in  CAPS.  The  vendor  that  mistakenly 
received  the  payment  returned  the  money  to  DFAS. 

•  DFAS  Rock  Island  received  invoice  number  39128  as  a  certified 
invoice  from  the  Watervilet  Arsenal,  Watervilet,  New  York.  Since 
the  invoice  was  not  date-stamped,  DFAS  Rock  Island  calculated  the 
payment  due  date  from  the  invoice  date  of  March  31,  2000,  rather 
than  the  constructive  acceptance  date  of  April  17,  2000.  The 


2Incorrect  invoice  receipt  date, 

incorrect  dollar  amount. 

4Incorrect  acceptance  date. 

5Incorrect  vendor  name  and  address. 
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payment  was  made  on  May  10,  2000,  instead  of  on  May  17,  2000. 
An  interest  payment  of  $1.54  was  inappropriately  paid  to  the  vendor. 

In  all  cases,  supporting  documentation  identified  that  the  technician  had  made  an 
error  in  computing  the  payment.  Certifying  officials  should  have  detected  these 
errors  and  returned  the  payments  for  correction. 

Vendor  Paid  More  Than  Amount  Due.  The  following  five  payments  were 
erroneous  because  the  payment  exceeded  the  amount  that  the  vendor  was 
entitled  to  receive. 


Payment 

Office 

Voucher 

Number 

Voucher 

Date 

Overpayment 

(Underpayment) 

Remedial 
Action  Taken 

Lawton 

259151 

7/11/00 

$  13.67 

No 

Lexington 

237165 

6/15/00 

25.34 

No 

Lexington 

207480 

7/7/00 

179.54 

No 

San  Antonio 

263071 

5/18/00 

857.22 

Yes 

St.  Louis 

274066 

5/5/00 

30,844.49 

No 

Discounts  Improperly  Taken.  The  following  two  erroneous  payments  were 
caused  by  technicians  taking  discounts  that  DoD  was  not  entitled  to  based  on  the 
payment  due  date. 

Payment  Voucher  Voucher  Overpayment  Remedial 

Office _ Number _ Date _ (Underpayment)  Action  Taken 

Europe  249379  7/21/00  $  (1.02)  No~ 

Lawton  253135  7/31/00  (4,759.91)  No 

Missing  or  Inconsistent  Supporting  Documents 


We  questioned  the  appropriateness  of  DFAS  field  sites  making  31  payments, 
valued  at  about  $2.4  million,  based  on  available  information.  The  payments 
were  made  without  proper  supporting  documents  or  the  supporting  documents 
contained  information  that  was  inconsistent  with  the  payment.  Table  F-2  shows 
the  number  of  payments  by  category  and  the  dollar  value  of  the  payments  that 
should  not  have  been  made  until  proper  documentation  was  obtained. 
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Table  F-2.  Missing  Supporting  Documents 

Category 

Number  of  Erroneous 
Payments 

Total  Dollar  Value  of 
Payments 

No  Invoice 

2 

3,755.58 

No  Invoice  and  Receiving 
Report 

1 

5,614.50 

No  Invoice,  Receiving 
Report  and  Obligation 
Document 

1 

28.24 

No  Receiving  Report 

10 

2,337,741.08 

No  Receiving  Report  and 
Obligation  Document 

3 

1,998.84 

3 

470.04 

Individual  Delivery  Orders 
Not  Issued 

8 

7,110.72 

Supporting  Documentation 
Did  Not  Match  Payment 

1 

248.00 

Payment  Inconsistent  With 
Contract 

2 

1707.84 

Total 

31 

$2,358,674.84 

No  Receiving  Report.  The  following  10  payments  were  made  without  a 
receiving  report. 


Payment  Office 

Voucher  Number 

Payment  Date 

Amount 

Department  97 

318547 

5/26/00 

$1,165,584.29 

Department  97 

301104 

7/28/00 

1,165,584.29 

DNO 

315333 

5/22/00 

137.22 

DNO 

317540 

5/25/00 

1,934.90 

DNO 

304648 

6/2/00 

112.36 

DNO 

315404 

7/21/00 

1,011.16 

Europe 

241638 

6/2/00 

1,396.30 

Orlando 

208431 

7/10/00 

975.00 

Rome 

226057 

6/1/00 

87.56 

San  Antonio 

251363 

7/27/00 

918.00 
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Individual  Delivery  Orders  Not  Issued.  Delivery  orders  were  not  issued  to 
authorize  the  following  eight  payments. 


Payment  Office 

Voucher  Number 

Payment  Date 

Amount 

Lawton 

5/3/00 

$2,419.34 

Lawton 

263764 

7/17/00 

1,548.40 

Rome 

211222 

5/11/00 

88.15 

Rome 

221938 

5/25/00 

1,275.67 

Rome 

239019 

6/19/00 

203.36 

Rome 

242917 

6/22/00 

995.45 

Rome 

203194 

6/30/00 

549.10 

Rome 

216037 

7/19/00 

31.25 

No  Receiving  Report  and  Obligation  Document.  The  following  three 

payments  were  made  without  a  receiving  report  and  obligation  document. 

Payment  Office 

Voucher  Number 

Payment  Date 

Amount 

Rome 

206779 

5/4/00 

$1,891.00 

San  Antonio 

Army  Recruiting 

260333 

5/11/00 

85.00 

Command 

305061 

5/3/00 

22.84 

No  Obligation  Document.  The  following  three  payments  were  made  without 
an  obligation  document. 

Payment  Office 

Voucher  Number 

Payment  Date 

Amount 

Lawton 

Army  Recruiting 

268685 

7/24/00 

$  44.25 

Command 

Army  Recruiting 

303740 

5/2/00 

372.62 

Command 

309166 

5/10/00 

53.17 

No  Invoice.  The  following  two  payments  were  made  without  an  invoice. 


Payment  Office  Voucher  Number  Payment  Date  Amount 

Europe  284835  6/5700  $2,513.20 

Rock  Island  279180  5/18/00  1,242.38 


No  Invoice  and  Receiving  Report.  The  following  payment  was  made  without 
an  invoice  and  receiving  report. 

Payment  Office  Voucher  Number  Payment  Date  Amount 

Rome  205993  574/00  $5,614.50 

Supporting  Documentation  Did  Not  Match  Payment.  The  supporting 
documents  for  the  following  payment  did  not  reflect  consistent  information. 

Payment  Office  Voucher  Number  Payment  Date  Amount 

San  Antonio  263760  5/18/00  $248.00 
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Payment  Inconsistent  With  the  Contract.  The  following  two  payments  were 
questionable  because  either  the  invoice  or  receiving  report  was  not  consistent 
with  the  contract. 


Payment  Office  Voucher  Number  Payment  Date  Amount 

DNO  306438  574/00  $  207.84 

Rock  Island  273339  6/6/00  1,500.00 


No  Supporting  Documentation.  The  following  payment  was  made  without  any 
supporting  documentation. 

Payment  Office  Voucher  Number  Payment  Date  Amount 

Orlando  2l4l23  7/18/00  $28^4 
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Appendix  G.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
Director  for  Acquisition  Initiatives 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Assistant  Secretary  of  the  Army  (Acquisition,  Logistics,  and  Technology) 
Auditor  General,  Department  of  the  Army 
Chief,  National  Guard  Bureau 


Department  of  the  Navy 

Naval  Inspector  General 

Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Finance  and  Accounting  Service 
Director,  Commercial  Pay  Services 

Non-Defense  Federal  Organization 

Office  of  Management  and  Budget 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
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Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member  (cont’d) 

Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Efficiency,  Financial  Management,  and 
Intergovernmental  Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  Technology  and  Procurement  Policy,  Committee  on 
Government  Reform 
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This  page  was  left  out  of  original  document 


Under  Secretary  of  Defense  (Comptroller) 
Comments 


coMrmou.eft' 


OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 
I  lOO  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-1  IOO 


DEC  27  2001 


MEMORANDUM  FOR  DIRECTOR  FOR  FINANCE  AND  ACCOUNTING,  OFFICE  OF 
THE  INSPECTOR  GENERAL,  DEPARTMENT  OF  DEFENSE 

SUBJECT:  Draft  Report  of  a  Proposed  Audit  Report  on  Controls  Over  Vendor  Payments  Made 
for  the  Army  and  Defense  Agencies  Using  the  Computerized  Accounts  Payable 
System  (Project  No.  D2000FI-0248.001) 


You  recently  forwarded  the  subject  draft  report  for  review  and  comment.  One  proposed 
recommendation  in  your  report  asked  the  Under  Secretary  of  Defense  (Comptroller)  (USD(C)), 
in  coordination  with  the  Defense  Finance  and  Accounting  Service,  to  develop  and  incorporate 
standard  business  rules  for  making  vendor  payments  into  the  Department  of  Defense  Financial 
Manauement  Regulation  ("DoDFMR”),  DoD  7000. 14-R. 

This  office  already  has  taken  action  to  revise  Volume  10,  Chapter  7,  “Prompt  Pay”  of  the 
“DoDFMR.”  That  revision  incorporates  the  prompt  pay  documentation  required  by 
Title  5,  Code  of  Federal  Regulations,  part  1315  (particularly  in  5  C.F.R.  1315.9)  and  includes  the 
requirement,  specified  in  the  Debt  Collection  Improvement  Act  of  1996,  to  obtain  a  vendor’s 
taxpayer  identification  number.  The  formal  30-day  electronic  coordination  period  for  that 
issuance  ended  on  November  29, 2001 . 

Following  receipt  and  consideration  of  the  remaining  comments  from  the  DoD 
Components,  this  office  will  issue  the  revised  policies  and  procedures  iu  Volume  10,  Chapter  7, 
of  the  “DoDFMR.”  Given  that  action  already  has  been  taken,  recommend  that  you  identify  the 
pending  completion  of  the  suggested  recommendation  in  your  final  report. 

My  point  of  contact  in  this  matter  is  Ms.  Melanie  Willis.  She  may  be  reached  by  e-mail  at 
willism@osd.pentagon.mil  or  by  telephone  at  (703)  602-0456. 


Acting  Deputy  Chief  Financial  Officer 
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Department  of  the  Army  Comments 


DEPARTMENT  OF  THE  ARMY 

OFFICE  OF  THE  ASSISTANT  SECRETARY 
(FINANCIAL  MANAGEMENT  AND  COMPTROLLER) 
109  ARMY  PENTAGON 
WASHINGTON  OC  SOS  10-0 109 

February  21/  2002 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  DIRECTORATE, 
ODODIG,  400  ARMY  NAVY  DRIVE, 

ARLINGTON,  VIRGINIA  22202-4704 


SUBJECT:  Audit  Report  on  Controls  Over  Vendor  Payments  Made  for  the 

Army  and  Defense  Agencies  Using  the  Computerized  Accounts  Payable 
System  (Project  No.  D2000FI-0248.001) 


Concur  with  subject  draft  audit  report,  dated  November  21,  2001.  To  comply  with 
your  recommendation,  we  will  work  with  your  office,  the  Defense  Finance  and 
Accounting  Service  and  the  Assistant  Secretary  of  the  Army  (Acquisition,  Logistics,  and 
Technology)  to  implement  recommendations  C.I.a,  C.I.b  and  C.1.3  and  issue  detailed 
written  guidance  for  the  processing  of  receiving  reports  by  March  15, 2002. 

To  help  obtain  properly  prepared  receiving  reports  in  a  timely  manner,  the  Army 
also  intends  to  pilot  Wide  Area  Work  Flow-  Receipt  and  Acceptance  version  2.0c  in 
United  States  Army,  Europe  by  May  2002. 

My  point  of  contact  is  LTC  Bob  Kucharuk.  He  may  be  reached  at  703-607-3969  or 
email  kucharukre@hada.armv.mil. 

fV  IjMimi  W - 

V  Ernest  J.  Gregory  COLi%^^\y 

\  Deputy  Assistant  Secretary  of  the  Army 
(Financial  Operations) 


Copy  furnished: 

Under  Secretary  of  Defense  (Comptroller) 

Director,  Defense  Finance  and  Accounting  Service 
Department  of  the  Army  Auditor  General 

Assistant  Secretary  of  the  Army  (Acquisition,  Logistics  and  Technology) 
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Defense  Finance  and  Accounting  Service 
Comments 


INKIW.Y 

AtFtKTO 


DFAS-BS/CC 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 
COLUMBUS  CENTER 

P.O.  BOX  182317 
COLUMBUS,  OHIO  43218-2317 


FEB  0  7  2002 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  DIRECTORATE, 

OFFICE  OF  THE  INSPECTOR  GENERAL,  DEPARTMENT  OF 
DEFENSE 

SUBJECT:  DoD  IG  Draft  Report,  Project  No,  D2000F 1-0248.00 1,  “Controls  Over  Vendor 

Payments  Made  for  the  Army  and  Other  Defense  Agencies  Using  the  Computerized 
Accounts  Payable  System,”  dated  November  21 , 2001 

Management  comments  for  Recommendations  A.l,  A.2,  B.1-B.7,  C.l,  and  C.2  are 
attached  as  requested. 

Point  of  contact  for  additional  information  is  Ms,  Janice  Hutton,  at  DSN  869-0868  or 
614  693-0868. 


JoAnn  Boutelle 

Director,  Commercial  Pay  Services 


Attachment 
As  stated 
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Comments  to  the  Draft  Proposed  Audit  Report,  Controls  Over  Vendor  Payments  Made  for 
the  Army  and  Defense  Agencies  Using  the  Computerized  Accounts  Payable  System 


Recommendation  A.1 :  Wc  recommend  that  the  Under  Secretary  of  Defense  (Comptroller),  in 
coordination  with  the  Director,  Commercial  Pay  Services,  develop  and  incorporate  into  DoD 
Regulation  7000. 1 4-R,  Volume  1 0,  standard  business  rules  for  making  vendor  payments. 

Management  Comments:  Partially  Concur.  A  Vendor  Pay  Standardization  Study  has  been 
conducted,  in  which  a  series  of  recommendations  have  been  made,  such  as  standard  practices  for 
date  stamping  documents,  document  management,  entering  and  certifying  entitlements,  and  pre- 
vaiidation  prior  to  payment  to  ensure  funds  are  available.  The  Commercial  Pay  Services 
Director  will  work  with  the  Undersecretary  of  Defense  (Comptroller)  on  appropriate  changes. 
Certain  items  will  not  be  incorporated  into  changes  to  DoD  Regulation  7000.14R,  Volume  10, 
such  as  changes  representing  detailed  processes  that  are  unique  to  specific  Vendor  Pay  Support 
Offices. 

Estimated  Completion  Date;  September  30, 2002. 

Recommendation  A.2:  Recommend  the  Director,  Commercial  Pay  Services,  improve  the 
identification  and  correction  of  problems  in  making  vendor  payments  by: 

Recommendation  A.2.a:  Identifying  the  best  practices  used  by  vendor  payment  offices  to 
detect  weaknesses  in  the  vendor  payment  process  and  designating  those  best  practices  as 
standard  reporting  and  monitoring  tools. 

Management  Comments;  Concur.  A  Vendor  Pay  Standardization  Study  was  conducted  at  nine 
Vendor  Pay  Offices,  and  20  changes  for  standardization  were  recommended.  The  Vendor  Pay 
study  is  currently  under  review  by  the  Vendor  Pay  Support  Directors.  Once  recommendations 
are  agreed  upon,  implementation  will  begin.  The  Commercial  Pay  Services  Director  meets 
quarterly  with  the  Vendor  Pay  Site  Managers  to  discuss,  review,  and  implement  best  practices. 
Identifying  mid  implementing  best  practices  is  a  continuous  process  and  will  be  a  topic  of 
discussion  at  the  quarterly  meetings. 

Estimated  Completion  Date:  This  recommendation  is  considered  closed. 

Recommendation  A.2.b:  Verifying  that  the  Predator  software  application  has  been  properly 
installed  at  all  field  sites  and  providing  individuals  who  run  the  Predator  software  with  sufficient 
training. 

Management  Comments:  Partially  concur.  Predator  software  was  installed  at  all  Vendor  Pay 
sites  in  the  Army  network  by  the  end  of  calendar  year  1999.  Currently,  the  Predator  software 
application  produces  a  high  number  of  false  positives.  Reviewing  the  high  number  of  false 
positives  takes  an  inordinate  amount  of  time.  As  a  result  an  evaluation  is  being  conducted  to 
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improve  the  screening  process  and  reduce  necessitated  time-consuming  research.  The  STARS- 
One  Pay  system,  used  to  process  Navy  Vendor  Payments,  contains  edits  and  query  capabilities  to 
identify  potential  duplicate  payments  prior  to  disbursement.  We  will  compare  the  STARS-One 
Pay  system  edits  to  Predator  to  determine  if  Predator  should  be  fielded  by  the  Navy  support  sites. 

Estimated  Completion  Pate:  This  recommendation  is  considered  closed. 


Recommendation  A.2.c:  Performing  monthly  post-payment  voucher  reviews  to  ensure  that 
payments  are  legal,  proper,  and  correct  for  payment. 

Management  Comments:  Partially  concur.  DoD  Regulation  7000. 14-R,  volume  5,  specifies 
that  post-payment  reviews  be  conducted,  but  does  not  specify  the  frequency  of  the  reviews. 
Commercial  Pay  Services  is  currently  conducting  annual  scheduled  post-payment  reviews  at  all 
Vendor  Pay  sites.  When  sites  are  identified  with  less  than  95%  accuracy,  a  follow-up  review  is 
conducted  within  90  days  to  verify  corrective  actions  have  been  taken  and  are  effective  in 
improving  accuracy,  (see  attached  schedule) 

Estimated  Completion  Date:  This  recommendation  is  considered  closed. 

Recommendation  A,2,d:  Establishing  performance  measures  that  will  track  the  number  and 
dollar  value  of  duplicate  payments  and  other  improper  payments. 

Management  Comments:  Concur.  New  Performance  Measurement  Indicators  (PMI)  are  being 
developed  to  monitor  the  number  and  dollar  value  of  duplicate  and  other  improper  payments. 
Additionally,  improvements  to  the  Predator  software  will  be  implemented  in  May  2002,  which 
will  reduce  the  number  of  false  positives  and  make  the  data  more  feasible  to  use  for  PMIs. 

Estimated  Completion  Date:  June  28, 2002. 


Recommendation  B:  We  recommend  that  the  Director,  Commercial  Pay  Services: 

Recommendation  B.1:  Develop  and  implement  standard  system  access  profiles  to  complement 
a  standard  business  structure  for  making  payments  using  the  Computerized  Accounts  Payable 
System. 

Management  Comments:  Concur.  Standard  system  access  profiles  for  making  payments  using 
CAPS  are  currently  being  evaluated,  Once  the  evaluation  is  complete,  the  profiles  will  become 
standardized  for  making  payments  using  CAPS.  Implementation  of  profiles  with  appropriate 
realignment  of  organizational  elements  will  take  place  in  June  2002. 

Estimated  Completion  Date:  June  28,  2002. 
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Recommendation  B,2:  Evaluate  the  ability  of  smaller  vendor  payment  offices  to  use  standard 
system  profiles.  As  necessary,  increase  the  staffing  needed  to  adequately  segregate  duties  or 
relocate  vendor  payment  operations  to  a  field  site  that  can  properly  segregate  duties. 

Management  Comments:  Partially  Concur.  An  evaluation  is  being  conducted  to  determine  the 
ability  of  smaller  vendor  payment  offices  to  use  standard  system  profiles.  Proper  segregation  of 
duties  will  also  be  evaluated. 

Estimated  Completion  Date;  June  28,  2002. 


Recommendation  B.3:  Remove  remote  access  to  update  and  certify  information  in  the 
Computerized  Accounts  Payable  System  for  Windows  until  the  system  can  provide  proper 
segregation  of  duties  and  security  over  remotely  entered  data. 

Management  Comments:  Partially  Concur.  Remote  certification  access  in  CAPS  has  been 
removed  at  alJ  Army  Vendor  Pay  Support  Sites.  The  DFAS  Commercial  Pay  Business  Line 
(CPBL)  System  Access  Evaluation  Project  is  developing  two  remote  access  profiles  within 
CAPS-W  that  provide  for  one  remote  user  to  input  contracts,  modifications,  invoices,  and 
receiving  report  information,  and  a  separate  user  to  compute  payments.  The  profiles  will  be 
standardized  within  CAPS-W  and  authorization  and  assignment  will  be  controlled  via  DISA 
Form  41,  under  the  approval  of  the  Director,  Army  Vendor  Pay  Support. 

Estimated  Completion  Date:  June  28, 2002. 


Recommendation  B.4:  Develop  a  plan  of  action  to  have  field  sites  using  the  Clipper  version  of 
the  Computerized  Accounts  Payable  System  use  another  vendor  payment  system  unless  system 
access  controls  can  be  improved  and  other  system  deficiencies  corrected  in  a  cost-effective 
manner. 

Management  Comments:  Partially  Concur.  CAPS  Clipper  access  controls  are  included  in  the 
CAPS  System  Access  Evaluation  Project.  During  the  evaluation,  a  determination  was  made  that 
improvements  and  system  access  controls  can  be  corrected  in  a  cost-effective  manner.  These 
improvements  to  system  access  controls  will  be  fielded  with  the  release  of  CAPS  Clipper  version 
7.0  in  July  2002. 

Estimated  Completion  Date:  July  31,  2002. 


Recommendation  B.3:  Develop  and  fund  system  change  requests  to  correct  password  and 
system  control  deficiencies  in  the  Computerized  Accounts  Payable  System  for  Windows. 

4anageroent  Comments:  Concur.  System  change  requests  have  been  developed  to  correct 
assword  and  system  control  deficiencies  in  CAPS-W.  The  change  will  be  included  in  the  CAPS 
srsion  7.0  release.  This  release  will  automatically  limit  logon  attempts  to  three  before  locking 
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the  user  out,  all  passwords  not  used  within  60  days  will  be  revoked.  Additionally,  this  release 
will  prevent  the  user  from  logging  into  multiple  work  stations  simultaneously. 

Estimated  Completion  Date:  July  31, 2002. 


Recommendation  B.6:  Develop  action  plans  for  overcoming  obstacles  that  prevent  the 
automated  interfacing  of  data  between  the  Computerized  Accounts  Payable  System  and  the 
Standard  Procurement  System  and  for  implementing  automated  interfaces  between  the  CAPS 
and  the  Corporate  Electronic  Funds  Transfer  database. 

Management  Comments:  Concur.  Obstacles  preventing  an  automated  interface  between 
CAPS  and  the  Standard  Procurement  System,  and  an  interface  between  CAPS  and  the  CEFT 
database,  have  been  identified.  An  MOA  between  DFAS  and  the  Army  addressing  the  interface 
between  SPS  and  CAPS  was  signed  on  November  26,  2001,  and  site  certification  is  underway. 
There  are  nine  Contracting  Offices  scheduled  for  certification  testing  in  FY  2002.  CAPS  system 
change  requests,  relative  to  receiving  SPS  files,  have  been  written  to  refine  SPS  files  (i.e.,  the 
automation  of  receipt  of  SPS  files  without  manual  intervention).  CAPS  is  scheduled  to  interface 
with  CEFT  in  the  6.0  Release  scheduled  for  November  2002. 

Estimated  Completion  Date:  November  29, 2002. 


Recommendation  B.7:  Report  access  and  control  deficiencies  with  the  CAPS  as  a  material 
control  weakness  in  the  Annual  Statement  of  Assurance  for  the  Defense  Finance  and  Accounting 
Service  until  proper  corrective  actions  can  be  implemented  or  the  system  is  replaced  by  the 
Defense  Procurement  Payment  System. 

Management  Comments:  Concur.  Two  material  weaknesses  titled,  “Separation  of  Duties/User 
Profiles  in  the  CAPS-W  and  Clipper”,  and  “Remote  Access  and  Processing  of  Vendor 
Payments”,  were  identified  in  the  DFAS  Columbus  FY  2001  Vendor  Pay  Services  Annual 
Statement  of  Assurance  as  material  weaknesses. 

Estimated  Completion  Date:  This  recommendation  is  considered  closed. 


Recommendation  C.l :  We  recommend  that  the  Assistant  Secretary  of  the  Army  (Financial 
Management  and  Comptroller),  in  coordination  with  the  Director,  Commercial  Pay  Services,  and 
the  Assistant  Secretary  of  the  Army  (Acquisition,  Technology,  and  Logistics): 

Recommendation  C.l. a:  Train  personnel  at  designated  billing  offices  on  the  requirements  for 
properly  date-stamping  documents  supporting  vendor  payments. 

Management  Comments:  Although  the  recommendation  is  to  the  Army,  we  may  provide 
assistance  as  requested. 
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Estimated  Completion  Dates:  This  recommendation  is  considered  closed. 


Recommendation  C.l.b:  Train  personnel  at  Army  activities  on  the  standards  for  proper  receipt 
and  acceptance  of  goods  and  services. 

Management  Comments:  Although  the  recommendation  is  to  the  Army,  we  may  provide 
assistance  upon  request. 

Estimated  Completion  Dates:  This  recommendation  is  considered  closed. 


Recommendation  C.l.c:  Cease  using  Standard  Form  1034  as  an  invoice,  receiving  report,  and 
obligation  document  and  only  allow  its  use  to  support  a  properly  certified  payment  as  authorized 
by  DoD  Regulation  7000. 14-R,  volume  10. 

Management  Comments:  Nonconcur.  Various  miscellaneous  payments,  such  as  legal  claims, 
are  allowed  to  be  paid  via  the  SF  1034,  in  accordance  with  FMR  Volume  10,  Chapter  8.  We  are 
encouraging  the  use  of  the  DD250  in  lieu  of  the  SF  1034  but  cannot  find  any  substantiating 
regulatory  guidance  which  prohibits  the  use  of  the  SF  1034. 

Estimated  Completion  Dates:  This  recommendation  is  considered  closed. 


Recommendation  C.2:  Recommend  the  Director,  Commercial  Pay  Services: 

Recommendation  C.2.a:  Direct  field  sites  to  use  the  invoice  date  for  computing  the  payment 
due  date  if  the  date  stamp  on  the  invoice  does  not  clearly  identify  that  the  office  designated  in  the 
contract  received  the  invoice. 

Management  Comments:  Partially  concur.  A  policy  letter  is  under  development  that  will 
require  use  of  the  invoice  date  for  computing  the  payment  due  date  when  the  date  stamp  on  the 
invoice  does  not  clearly  indicate  that  the  office  designated  in  the  contract  received  the  invoice 
(unless  communication  with  the  designated  office  can  substantiate  the  true  date  of  receipt  on  the 
invoice).  The  letter  is  currently  in  management  review.  Once  approved,  the  policy  letter  will  be 
sent  out  to  applicable  field  sites  to  use. 

Estimated  Completion  Date:  April  30,  2002. 


Recommendation  C.2.b:  Direct  field  sites  to  establish  a  procedure  for  determining  the 
reasonableness  of  receipt  and  acceptance  dates  and  returning  receiving  reports  that  provide 
unreasonable  dates. 
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Management  Comments:  Nonconcur.  Commercial  Pay  Services  does  not  set  reasonableness 
of  receipt  and  acceptance  dates.  This  is  the  responsibility  of  the  ordering  service  or  agency.  We 
will  continue  to  use  the  seven  day  constructive  acceptance  rule  contained  in  the  FAR. 

Estimated  Completion  Date:  This  recommendation  is  considered  closed. 


Recommendation  C.2.c:  Suspend  the  current  policy  of  making  payments  for  recurring  services 
without  a  receiving  report  until  adequate  controls  are  in  place  to  verify  that  payments  are  not 
being  made  until  acceptance  occurs  and  that  acceptance  documentation  is  properly  prepared  and 
maintained. 

Management  Comments:  Concur.  A  memorandum  will  be  written  by  Commercial  Pay 
Services  to  suspend  the  current  practice  of  making  payments  for  recurring  services  without  a 
receiving  report.  The  policy  will  suspend  making  payments  for  recurring  services  exempted  in 
DoD  Regulation  7000.1 4-R,  Volume  10,  Chapter  9,  Section  6,  paragraph  02,  which  allows  the 
receiving  reports  to  be  held  in  the  disbursing  office  or  the  receiving  activities  files  for  recurring 
service/maintenance  type  contracts.  Compensating  controls  are  being  identified  to  verify 
payments  are  not  being  made  until  acceptance  occurs,  and  that  acceptance  documentation  is 
properly  prepared  and  maintained. 

Estimated  Completion  Date;  April  30,  2002. 


Recommendation  C.2.d:  Conduct  an  audit  of  contract  number  DABT60-97-D-0007  to 
determine  if  duplicate  or  erroneous  payments  were  made. 

Management  Comments:  Concur.  Review  of  contract  number  DABT60-97-D-0007  is 
currently  ongoing.  The  review  of  payments  from  Rock  Island  and  St.  Louis  has  been  completed, 
and  duplicate  payments  were  not  identified  between  the  two  sites.  Payments  made  by  Lawton 
are  currently  under  review  to  determine  whether  payments  made  match  any  made  by  Rock  Island 
or  St.  Louis. 

Estimated  Completion  Date:  February  28,  2002. 


Recommendation  C.2.e:  Review  and  resolve  those  improper  payments  and  the  other 
questionable  payments  that  are  considered  significant. 

Management  Comments:  Concur.  Review  of  payments  made  under  DABT60-97-D-0007  is 
currently  ongoing.  Other  questionable  payments  identified  to  sites  during  the  review  have  been 
completed. 


Estimated  Completion  Pate:  February  28, 2002. 


Audit  Team  Members 

The  Finance  and  Accounting  Directorate,  Office  of  the  Assistant  Inspector  General  for 
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DoD,  who  contributed  to  the  report  are  listed  below. 

Paul  J.  Granetto 
Richard  B.  Bird 
Marvin  L.  Peek 
Carmelo  G.  Ventimiglia 
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